US 9,904,784 B2Granted

Kernel-level security agent

AssigneeCrowdStrike, Inc.

InventorsDavid F. Diehl, Dmitri Alperovitch, Ion-Alexandru Ionescu, George Robert Kurtz

Life of this patent

Estimating the term…

Loading patent…

Abstract

A kernel-level security agent is described herein. The kernel-level security agent is configured to observe events, filter the observed events using configurable filters, route the filtered events to one or more event consumers, and utilize the one or more event consumers to take action based at least on one of the filtered events. In some implementations, the kernel-level security agent detects a first action associated with malicious code, gathers data about the malicious code, and in response to detecting subsequent action(s) of the malicious code, performs a preventative action. The kernel-level security agent may also deceive an adversary associated with malicious code. Further, the kernel-level security agent may utilize a model representing chains of execution activities and may take action based on those chains of execution activities.

Claims20

Dependent claims

A computing system comprising:

at least one memory configured to store a situational model and computer-executable instructions of a kernel-level security agent;
and
one or more processors that, upon executing the computer-executable instructions, perform operations comprising:
observing a first event associated with one or more processes executing on the computing system;
accessing, from a kernel mode of the computing system, the situational model;
determining that the first event passes a first filter;
updating the situational model based at least in part on the first event to provide an updated situational model;
observing a second event associated with one or more processes executing on the computing system;
determining that the second event passes a second filter based at least in part on the updated situational model;
determining a preventative action to take based on at least one of the second event and the updated situational model;
and
performing the preventative action.

9 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/483,153Filed 10 Apr 2017 · continuation
Priority: 8 Jun 2012
Published: US 2017/0213031 A127 Jul 2017
Granted: 27 Feb 2018
Term ends: Not estimatedThe source records don’t support an estimate.

Classification16 codes

G06F 21/566
Computer malware detection or handling, e.g. anti-virus arrangements: dynamic detection, i.e. detection performed at run-time, e.g. emulation,…
G06F 9/46
Using stored programs, i.e. using an internal store of processing equipment to receive or retain programs: multiprogramming arrangements
G06F 21/554
Detecting local intrusion or implementing counter-measures: involving event detection and direct action
G06F 21/56
Detecting local intrusion or implementing counter-measures: computer malware detection or handling, e.g. anti-virus arrangements

Family

Application13/492,672Parent of this continuation · filed 8 Jun 2012
Application14/709,779Parent of this continuation · filed 12 May 2015
US 9,043,903 B2Parent of this continuation · filed 26 May 2015
US 2017/0213031 A1Pre-grant publication · published 27 Jul 2017
US 9,621,515 B2Parent of this continuation
US 2013/0333040 A1Published application
US 2015/0244679 A1Published application
US 9,904,784 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key