# US 2024/0202097 A1 · Techniques for tracking process activity

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2024/0202097 A1
- Document ID: US20240202097A1
- Status: Published application
- Kind: A1
- Application number: 18/081,144
- Filed: 2022-12-14
- Published: 2024-06-20
- Earliest claimed: 2022-12-14
- Assignees: CrowdStrike, Inc.
- Applicants: CrowdStrike, Inc.
- Inventors: Martin Kelly; Marco Vedovati; Igor Polevoy; Milos Petrbok
- Web page: https://patentgrep.com/patent/US20240202097A1

## CPC

- G06F 11/3495: {for systems}
- G06F 9/445: Program loading or initiating (bootstrapping G06F9/4401; security arrangements for program loading or initiating G06F21/57)
- G06F 9/545: {where tasks reside in different layers, e.g. user- and kernel-space}
- G06F 11/302: {where the computing system component is a software system}
- G06F 11/3419: {by assessing time}
- G06F 11/3466: {Performance evaluation by tracing or monitoring}
- G06F 21/44: Program or device authentication
- G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine
- G06F 21/552: {involving long-term monitoring or reporting}
- G06F 21/562: {Static detection}
- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06F 21/725: {operating on a secure reference time value}
- G06F 2201/865: Monitoring of software
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A unique process identifier (UPID) associated with a process identifier (PID) of a process executing in an operating system is generated in a kernel space of the operating system executing on a computing device. The UPID is inserted into a first mapping store that maps the PID to the UPID. A message is transmitted including the PID to a message buffer structure. A second mapping store that maps the UPID to the PID is updated in a user space of the operating system based on the message.

## Claims

### Claim 1

A method comprising:
generating, in a kernel space of an operating system executing on a computing device, a unique process identifier (UPID) associated with a process identifier (PID) of a process executing in the operating system;
inserting the UPID into a first mapping store that maps the PID to the UPID;
transmitting, by a processing device, a message comprising the PID to a message buffer structure; and
updating, in a user space of the operating system, a second mapping store that maps the UPID to the PID based on the message.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
generating the UPID responsive to detecting a creation of the process in the kernel space of the operating system.

### Claim 3 (depends on 1)

The method of claim 1, wherein the first mapping store comprises a memory structure shared between the kernel space and the user space of the operating system.

### Claim 4 (depends on 1)

The method of claim 1, wherein the UPID is generated by an application extension executing in an extended Berkeley packet filter (eBPF) infrastructure within the operating system of the computing device.

### Claim 5 (depends on 1)

The method of claim 1, wherein the UPID is generated based on a monotonic clock of the computing device.

### Claim 6 (depends on 1)

The method of claim 1, wherein the process is a first process, the PID is a first PID, and the UPID is a first UPID, the method further comprising
generating, in the kernel space of the operating system, a second UPID associated with a second process having a second PID executing in the operating system, wherein the second UPID is different from the first UPID and the first PID is equal to the second PID.

### Claim 7 (depends on 1)

The method of claim 1, wherein the process is a first process, the PID is a first PID, and the UPID is a first UPID, and
wherein the method further comprises:
collecting process activity associated with a second process in the user space of the operating system, the second process having a second PID;
accessing the first mapping store to determine a second UPID mapped to the second PID; and
generating a transmission including the process activity and the UPID.

### Claim 8

A system comprising:
a memory; and
a processing device, operatively coupled to the memory, to:
generate, in a kernel space of an operating system executing on a computing device, a unique process identifier (UPID) associated with a process identifier (PID) of a process executing in the operating system;
insert the UPID into a first mapping store that maps the PID to the UPID;
transmit a message comprising the PID to a message buffer structure; and
update, in a user space of the operating system, a second mapping store that maps the UPID to the PID based on the message.

### Claim 9 (depends on 8)

The system of claim 8, wherein the processing device is further to generate the UPID responsive to detecting a creation of the process in the kernel space of the operating system.

### Claim 10 (depends on 8)

The system of claim 8, wherein the first mapping store comprises a memory structure shared between the kernel space and the user space of the operating system.

### Claim 11 (depends on 8)

The system of claim 8, wherein the UPID is generated by an application extension executing in an extended Berkeley packet filter (eBPF) infrastructure within the operating system of the computing device.

### Claim 12 (depends on 8)

The system of claim 8, wherein the UPID is generated based on a monotonic clock of the computing device.

### Claim 13 (depends on 12)

The system of claim 12, wherein the process is a first process, the PID is a first PID, and the UPID is a first UPID, and
wherein the processing device is further to:
generate, in the kernel space of the operating system, a second UPID associated with a second process having a second PID executing in the operating system, wherein the second UPID is different from the first UPID and the first PID is equal to the second PID.

### Claim 14 (depends on 8)

The system of claim 8, wherein the process is a first process, the PID is a first PID, and the UPID is a first UPID, and
wherein the processing device is further to:
collect process activity associated with a second process in the user space of the operating system, the second process having a second PID;
access the first mapping store to determine a second UPID mapped to the second PID; and
generate a transmission including the process activity and the UPID.

### Claim 15

A non-transitory computer-readable storage medium including instructions that, when executed by a processing device, cause the processing device to:
generate, in a kernel space of an operating system executing on a computing device, a unique process identifier (UPID) associated with a process identifier (PID) of a process executing in the operating system;
insert the UPID into a first mapping store that maps the PID to the UPID;
transmit, by the processing device, a message comprising the PID to a message buffer structure; and
update, in a user space of the operating system, a second mapping store that maps the UPID to the PID based on the message.

### Claim 16 (depends on 15)

The non-transitory computer-readable storage medium of claim 15, wherein the instructions further cause the processing device to generate the UPID responsive to detecting a creation of the process in the kernel space of the operating system.

### Claim 17 (depends on 15)

The non-transitory computer-readable storage medium of claim 15, wherein the first mapping store comprises a memory structure shared between the kernel space and the user space of the operating system.

### Claim 18 (depends on 17)

The non-transitory computer-readable storage medium of claim 17, wherein the UPID is generated based on a monotonic clock of the computing device.

### Claim 19 (depends on 15)

The non-transitory computer-readable storage medium of claim 15, wherein the process is a first process, the PID is a first PID, and the UPID is a first UPID, and
wherein the instructions further cause the processing device to:
generate, in the kernel space of the operating system, a second UPID associated with a second process having a second PID executing in the operating system, wherein the second UPID is different from the first UPID and the first PID is equal to the second PID.

### Claim 20 (depends on 15)

The non-transitory computer-readable storage medium of claim 15, wherein the process is a first process, the PID is a first PID, and the UPID is a first UPID, and
wherein the instructions further cause the processing device to:
collect process activity associated with a second process in the user space of the operating system, the second process having a second PID:
access the first mapping store to determine a second UPID mapped to the second PID; and
generate a transmission including the process activity and the UPID.