Detecting kernel exploits
AssigneeCapsule8, Inc.
InventorPeter Laurence Markowsky
Life of this patent
Estimating the term…
Abstract
Monitoring is performed for the activation of a set of one or more previously attached Kprobes. A determination is made that a strategy pattern match has occurred. The strategy pattern comprises a set of one or more behaviors including the activation of the at least one Kprobe included in the set of Kprobes. A remedial action is taken in response to the determination. Examples of such remedial actions include generating an alert and terminating a network connection.
Claims20
A system, comprising:
- a memory storing instructions;
- and
- a processor configured by the instructions stored in the memory to:
- monitor a kernel of a computing node for the activation of a set of one or more previously attached Kprobes;
- determine that a strategy pattern match has occurred by detecting, with an activation of at least one of the previously attached Kprobes, a modification to a bit in a control register of the computing node that disables execution prevention or access prevention in a memory of the kernel of the computing node;
- and
- take a remedial action in response to the determination that the strategy pattern has been matched.
A method, comprising:
- monitoring a kernel of a computing node for the activation of a set of one or more previously attached Kprobes;
- determining that a strategy pattern match has occurred by detecting, with an activation of at least one of the previously attached Kprobes, a modification to a bit in a control register of the computing node that disables execution prevention or access prevention in a memory of the kernel of the computing node;
- and
- taking a remedial action in response to the determination that the strategy pattern has been matched.
A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
- monitoring a kernel of a computing node for the activation of a set of one or more previously attached Kprobes;
- determining that a strategy pattern match has occurred by detecting, with an activation of at least one of the previously attached Kprobes, a modification to a bit in a control register of the computing node that disables execution prevention or access prevention in a memory of the kernel of the computing node;
- and
- taking a remedial action in response to the determination that the strategy pattern has been matched.
Dependencies are inferred from the claim text.