Back to results
US 11,106,800 B1Granted
Detecting kernel exploits
AssigneeCapsule8, Inc.
InventorPeter Laurence Markowsky
Life of this patent
Estimating the term…
Abstract
A kernel is monitored for occurrence of a set of Kprobes. A determination is made that a Strategy that makes use of at least one Kprobe included in the set of Kprobes has been matched. A remedial action is taken in response to the determination. Examples of such remedial actions include generating an alert and terminating a network connection.
Claims27
A system, comprising:
- a processor configured to:
- monitor for an activation of a set of one or more previously attached Kprobes;
- determine that a security violation corresponding to a strategy pattern match has occurred, wherein the strategy pattern comprises a set of one or more behaviors including the activation of at least one Kprobe included in the set of Kprobes, wherein the at least one activated Kprobe is indicative of a security feature having been disabled;
- and
- take a remedial action in response to the determination that the security violation has occurred;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
4 more elements
A method, comprising:
- monitoring for an activation of a set of one or more previously attached Kprobes;
- determining that a security violation corresponding to a strategy pattern match has occurred, wherein the strategy pattern comprises a set of one or more behaviors including the activation of at least one Kprobe included in the set of Kprobes, wherein the at least one activated Kprobe is indicative of a security feature having been disabled;
- and
- taking a remedial action in response to the determination that the security violation has occurred.
1 more element
A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
- monitoring for an activation of a set of one or more previously attached Kprobes;
- determining that a security violation corresponding to a strategy pattern match has occurred, wherein the strategy pattern comprises a set of one or more behaviors including the activation of at least one Kprobe included in the set of Kprobes, wherein the at least one activated Kprobe is indicative of a security feature having been disabled;
- and
- taking a remedial action in response to the determination that the security violation has occurred.
1 more element
Dependencies are inferred from the claim text.