Microsoft Technology Licensing, LLC

Crowdstrike, Inc.

Milos Petrbok

Jason Bradley Scott

Gavin M Gear

Kevin Phillip Paulson

Nikhil Subramanian

Colin Christopher McCambridge

David Frederick Diehl

Martin Kelly

Marco Vedovati

Alexander Nip

Igor Polevoy

Aaron Putnam

Christopher White

Colin Christopher Mccambridge

Methods and systems for implementing division of process resources of running processes into individually locked partitions, and indirect mapping of keys to process resources to locks of each partition, are provided. In computing systems implementing concurrent processing, applications may generate and destroy concurrently running processes with high frequency. Real-time security monitoring may cause the computing system to run monitoring processes collecting large volumes of data regarding system events occurring in context of various other processes, causing threads of processes of the security monitoring application to make frequent write access and read access to resources of those processes in memory. Indirect mapping of lock acquisition across locks provides scalable alleviation of lock contention and thread blocking that result from computational concurrency, while handling read and write requests which arise at unpredictable times from kernel-space monitoring processes, and which request unpredictable resources of monitored user-space processes.

Multiple locking of resources and lock scaling in concurrent computing

A method includes retrieving, in a kernel space of an operating system executing on a computing device, a first value from a first clock source, retrieving, in a user space of the operating system executing on the computing device, a second value from a second clock source, generating a unique process identifier (UPID) associated with a process identifier (PID) of a process executing in the operating system, wherein the UPID is based on the first value of the first clock source and the second value of the second clock source, and tracking process activity of the process executing in the operating system by utilizing the UPID.

Techniques for generating unique identifiers for tracking process activity

Some examples detect malicious activity on a computing device. A processor in kernel mode detects an event on the computing device. The processor provides a validation request on a kernel-level bus. A bidirectional bridge component transmits the request to a user-level bus. The processor in user mode determines that the event is associated with malicious activity and provides a validation response on the user-level bus. The bridge component transmits the validation response to the kernel-level bus. In some examples, the processor in user mode receives security-relevant information from a system service of the computing device, and analyzes the event based at least in part on the security-relevant information. In some examples, the processor in user mode receives a security query, queries the kernel mode via the bridge component, and responds to the security query indicating that the data stream is associated with malware.

Kernel- and user-level cooperative security processing

A symmetric, cross-platform, bridge component is described herein. The bridge component creates an interface (through a set of application programming interfaces (APIs)) to enable the sending of data between a pair of components, called 'endpoints,' a first endpoint component of the pair being executed in a kernel mode of a computing device, and a second endpoint component of the pair being executed in a user mode of the computing device. A process for sending data between a kernel-level endpoint component and a user-level endpoint component executing on a computing device involves opening a communications port, setting the communications port to a connected state, and sending a message containing the data via the communications port. Data may be transmitted in this manner between the user mode and the kernel mode of the computing device in either direction.

Symmetric bridge component for communications between kernel mode and user mode

Methods and a computing device are disclosed. A computing device may aggregate a number of inputs indicative of a presence or an absence of a human being within a proximity of the computing device. A source of at least one of the inputs may be a human presence sensor. A source of other inputs may provide an indication of the presence of a human being with corresponding estimated probabilities or corresponding estimated reliabilities which may provide an estimate of an accuracy of respective indications. In some embodiments, if any of the number of inputs indicate the presence of a human being, the computing device may determine that a human being is present. In other embodiments, if a corresponding estimated probability or reliability of an input is less than a predetermined value, then the input may be discarded when determining whether a human being is present.

Human presence detection

Growing community of inventors

Redmond, WA, United States of America

Milos Petrbok