Crowdstrike, Inc.

Colin Christopher McCambridge

Milos Petrbok

David Frederick Diehl

Aaron Putnam

Some examples detect malicious activity on a computing device. A processor in kernel mode detects an event on the computing device. The processor provides a validation request on a kernel-level bus. A bidirectional bridge component transmits the request to a user-level bus. The processor in user mode determines that the event is associated with malicious activity and provides a validation response on the user-level bus. The bridge component transmits the validation response to the kernel-level bus. In some examples, the processor in user mode receives security-relevant information from a system service of the computing device, and analyzes the event based at least in part on the security-relevant information. In some examples, the processor in user mode receives a security query, queries the kernel mode via the bridge component, and responds to the security query indicating that the data stream is associated with malware.

Kernel- and user-level cooperative security processing

A symmetric, cross-platform, bridge component is described herein. The bridge component creates an interface (through a set of application programming interfaces (APIs)) to enable the sending of data between a pair of components, called 'endpoints,' a first endpoint component of the pair being executed in a kernel mode of a computing device, and a second endpoint component of the pair being executed in a user mode of the computing device. A process for sending data between a kernel-level endpoint component and a user-level endpoint component executing on a computing device involves opening a communications port, setting the communications port to a connected state, and sending a message containing the data via the communications port. Data may be transmitted in this manner between the user mode and the kernel mode of the computing device in either direction.

Growing community of inventors

Minneapolis, MN, United States of America

Colin Christopher McCambridge