Techniques for tracking process activity
AssigneeCrowdStrike, Inc.
InventorsMartin Kelly, Marco Vedovati, Igor Polevoy, Milos Petrbok
Life of this patent
Estimating the term…
Abstract
A unique process identifier (UPID) associated with a process identifier (PID) of a process executing in an operating system is generated in a kernel space of the operating system executing on a computing device. The UPID is inserted into a first mapping store that maps the PID to the UPID. A message is transmitted including the PID to a message buffer structure. A second mapping store that maps the UPID to the PID is updated in a user space of the operating system based on the message.
Claims20
A method comprising:
- generating, in a kernel space of an operating system executing on a computing device, a unique process identifier (UPID) associated with a process identifier (PID) of a process executing in the operating system;
- inserting the UPID into a first mapping store that maps the PID to the UPID;
- transmitting, by a processing device, a message comprising the PID to a message buffer structure;
- and
- updating, in a user space of the operating system, a second mapping store that maps the UPID to the PID based on the message.
A system comprising:
- a memory;
- and
- a processing device, operatively coupled to the memory, to:
- generate, in a kernel space of an operating system executing on a computing device, a unique process identifier (UPID) associated with a process identifier (PID) of a process executing in the operating system;
- insert the UPID into a first mapping store that maps the PID to the UPID;
- transmit a message comprising the PID to a message buffer structure;
- and
- update, in a user space of the operating system, a second mapping store that maps the UPID to the PID based on the message.
A non-transitory computer-readable storage medium including instructions that, when executed by a processing device, cause the processing device to:
- generate, in a kernel space of an operating system executing on a computing device, a unique process identifier (UPID) associated with a process identifier (PID) of a process executing in the operating system;
- insert the UPID into a first mapping store that maps the PID to the UPID;
- transmit, by the processing device, a message comprising the PID to a message buffer structure;
- and
- update, in a user space of the operating system, a second mapping store that maps the UPID to the PID based on the message.
Dependencies are inferred from the claim text.