# US 9,904,784 B2 · Kernel-level security agent > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,904,784 B2 - Document ID: US9904784B2 - Status: Granted - Kind: B2 - Application number: 15/483,153 - Filed: 2017-04-10 - Published: 2017-07-27 - Granted: 2018-02-27 - Earliest claimed: 2012-06-08 - Assignees: CrowdStrike, Inc. - Applicants: CrowdStrike, Inc. - Inventors: David F. Diehl; Dmitri Alperovitch; Ion-Alexandru Ionescu; George Robert Kurtz - Web page: https://patentgrep.com/patent/US9904784B2 ## CPC - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 9/46: Multiprogramming arrangements - G06F 21/554: {involving event detection and direct action} - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F 21/567: {using dedicated hardware} - G06F 21/568: {eliminating virus, restoring damaged files} - G06N 5/04: Inference or reasoning models - H04L 41/0803: Configuration setting - H04L 63/0245: {Filtering by information in the payload} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/1491: {using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment} - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A kernel-level security agent is described herein. The kernel-level security agent is configured to observe events, filter the observed events using configurable filters, route the filtered events to one or more event consumers, and utilize the one or more event consumers to take action based at least on one of the filtered events. In some implementations, the kernel-level security agent detects a first action associated with malicious code, gathers data about the malicious code, and in response to detecting subsequent action(s) of the malicious code, performs a preventative action. The kernel-level security agent may also deceive an adversary associated with malicious code. Further, the kernel-level security agent may utilize a model representing chains of execution activities and may take action based on those chains of execution activities. ## Claims ### Claim 1 A computing system comprising: at least one memory configured to store a situational model and computer-executable instructions of a kernel-level security agent; and one or more processors that, upon executing the computer-executable instructions, perform operations comprising: observing a first event associated with one or more processes executing on the computing system; accessing, from a kernel mode of the computing system, the situational model; determining that the first event passes a first filter; updating the situational model based at least in part on the first event to provide an updated situational model; observing a second event associated with one or more processes executing on the computing system; determining that the second event passes a second filter based at least in part on the updated situational model; determining a preventative action to take based on at least one of the second event and the updated situational model; and performing the preventative action. ### Claim 2 (depends on 1) The computing system of claim 1, the operations further comprising tracking attributes or behaviors of one or more objects or processes of the computing system in the situational model. ### Claim 3 (depends on 2) The computing system of claim 2, wherein the operations for determining that the first event passes the first filter comprise querying the situational model from the kernel mode. ### Claim 4 (depends on 1) The computing system of claim 1, further comprising a network interface, the operations for performing the preventative action comprising informing a remote security system of at least one of the first event or the second event via the network interface. ### Claim 5 (depends on 4) The computing system of claim 4, the operations further comprising receiving, in response, at least: instructions for performing a further action; or a configuration update. ### Claim 6 (depends on 1) The computing system of claim 1, the operations further comprising receiving one or more events, configuration updates, or instructions for performing actions from a remote security system independently of communications from the kernel-level security agent to the remote security system. ### Claim 7 (depends on 1) The computing system of claim 1, the operations further comprising: noting, using at least one correlator module, the fact of the occurrence of the first event; determining an association between the occurrence of the first event and at least one of a threshold, a set, a sequence, a Markov chain, or a finite state machine; and providing a third event further based at least in part on the association, wherein the preventative action is performed based at least in part on the third event. ### Claim 8 (depends on 1) The computing system of claim 1, the operations further comprising producing a third event in response to at least: the determination that the first event passes the first filter; or the determination that the second event passes the second filter. ### Claim 9 (depends on 1) The computing system of claim 1, the operations for performing the preventative action comprising at least: gathering forensic data associated with at least the first event or the second event, storing the forensic data in a model, informing a remote security system of the filtered events, halting a first process associated with at least the first event or the second event, or deceiving the first process. ### Claim 10 (depends on 1) The computing system of claim 1, the operations further comprising updating, replacing, or removing one or more components of the kernel-level security agent while the kernel-level security agent continues to operate. ### Claim 11 (depends on 10) The computing system of claim 10, wherein an existing component of the kernel-level security agent designated to be replaced or removed continues to operate during an update of the kernel-level security agent. ### Claim 12 (depends on 1) The computing system of claim 1, the operations further comprising, in response to determining that the first event passes the first filter, routing the first event to at least a correlator module, the situational model, an actor component, or a communications module. ### Claim 13 (depends on 1) The computing system of claim 1, the operations further comprising scheduling asynchronous events for processing by one or more kernel-mode event consumers of the kernel-level security agent. ### Claim 14 (depends on 1) The computing system of claim 1, the operations further comprising at least: observing events associated with multiple processes or threads in parallel, filtering the multiple observed events in parallel, routing the multiple filtered events in parallel, or processing events using multiple event consumers in parallel. ### Claim 15 (depends on 1) The computing system of claim 1, the operations further comprising, using one or more kernel-mode event consumers of the kernel-level security agent: determining that the second event is associated with a malicious code of the system, the second event occurring after observation of the first event by the kernel-level security agent; and in response, performing the preventative action. ### Claim 16 (depends on 1) The computing system of claim 1, wherein the computer-executable instructions of the kernel-level security agent comprise computer-executable instructions of at least: a configuration manager configured to receive the configuration updates from a remote security system; a component manager configured to load or unload a new component based on the configuration update; a state manager configured to persist state information between old and new components; a storage manager configured to interface with storage of the system on behalf of the kernel-level security agent, or an integrity manager configured to observe, filter, and route events during an update of core components and managers of the kernel-level security agent. ### Claim 17 (depends on 1) The computing system of claim 1, wherein the computer-executable instructions of the kernel-level security agent comprise computer-executable instructions of at least: a hypervisor, a pre-boot component configured to leverage hardware-provided security features, or a pre-boot component configured not to leverage hardware-provided security features. ### Claim 18 (depends on 1) The computing system of claim 1, the operations further comprising: using at least one collector module, observing events in a user mode of the computing system; and using at least one configurable filter, filtering the events in the user mode of the computing system. ### Claim 19 (depends on 1) The computing system of claim 1, wherein the kernel-level security agent is a secure operating system that launches prior to a system operating system. ### Claim 20 (depends on 1) The computing system of claim 1, wherein the operations further comprise determining that the first event passes the first filter based at least in part on the situational model.