Dynamic rule management for kernel mode filter drivers

A method for providing rules for a plurality of processes launchable in a user mode of a computer from the user mode to one or more filter drivers implemented in a kernel mode of the computer, the method comprising:

• obtaining a policy for at least a first process of the plurality of processes, the policy indicating at least when and/or how notifications are to be provided from the kernel mode to the user mode upon detection in the kernel mode of launching of the first process;
• in response to receiving, in the user mode from the kernel mode, a first notification in accordance with the policy for the first process, selecting, from the rules stored in the user mode, rules related to the launching of the first process;
• and
• providing the selected rules related to the launching of the first process from the user mode to at least one of the one or more filter drivers.

A system for providing rules for a plurality of processes launchable in a user mode of a computer from the user mode to one or more filter drivers implemented in a kernel mode of the computer, the system comprising:

• a managing kernel unit implemented in the kernel mode of the computer;
• a process management unit implemented in the user mode of the computer;
• and
• a rule provider implemented in the user mode of the computer,
• wherein the rule provider is configured for storing the rules,
• wherein the managing kernel unit is configured for:
• obtaining a policy for at least a first process of the plurality of processes, the policy indicating at least when and/or how notifications are to be provided from the kernel mode to the user mode upon detection in the kernel mode of launching of the first process, and
• in response to detecting the launching of the first process, providing a first notification to the process management unit in accordance with the obtained policy for the first process, and
• wherein the process management unit is configured for:
• in response to receiving the first notification from the managing kernel unit, selecting, from the rules stored in the rule provider, rules related to the launching of the first process, and
• providing the selected rules related to the launching of the first process from to at least one of the one or more filter drivers and/or the managing kernel unit.