US 12,111,937 B2 · Memory scan-based process monitoring

Abstract

A technique includes an operating system agent of a computer system monitoring a process to detect whether an integrity of the process has been compromised. The monitoring includes the operating system agent scanning a data structure. The process executes in a user space, and the data structure is part of an operating system kernel space. The technique includes a hardware controller of the computer system listening for a heartbeat that is generated by the operating system agent. The hardware controller takes a corrective action in response to at least one of the hardware controller detecting an interruption of the heartbeat, or the operating system agent communicating to the hardware controller a security alert for the process.

Claims24

Dependent claims

A method comprising:

monitoring, by an operating system agent of a computer system, a process to detect whether an integrity of the process has been compromised, wherein the operating system agent is part of an operating system kernel, wherein a kernel memory space associated with the process stores code corresponding to the operating system kernel, and wherein the monitoring comprises;
scanning, by the operating system agent, the kernel memory space to identify a shared library object;
and
determining, by the operating system agent, whether the integrity of the process is compromised based on a property of the shared library object;
providing, by the operating system agent, a heartbeat, wherein the heartbeat comprises a sequence of indications following a schedule to represent that the operating system agent is operating in an acceptable state;
and
initiating, by a hardware controller of the computer system, a responsive action in response to an interruption of the heartbeat.

4 more elements

A computer platform comprising:

a processor to:
execute instructions to cause the processor to provide an operating system agent to monitor a process to detect whether an integrity of the process has been compromised, wherein the operating system agent is part of an operating system kernel, wherein a kernel memory space associated with the process stores code corresponding to the operating system kernel, and wherein the monitoring comprises:
scanning, by the operating system agent, the kernel memory space to identify a given shared library object;
and
determining, by the operating system agent, whether the integrity of the process is compromised based on a property of the given shared library object;
provide a heartbeat, wherein the heartbeat comprises a sequence of indications following a schedule to represent that the operating system agent is operating in an acceptable state;
and
a controller independent from the operating system agent to:
monitor the heartbeat;
and
initiate a responsive action in response to an interruption of the heartbeat.

8 more elements

Dependencies are inferred from the claim text.

Memory scan-based process monitoring

Life of this patent

Memory scan-based process monitoring

Life of this patent

Abstract

Claims24