Patent ID: 9621515
Date: 2017-04-11
CPC Classifications: G06F,G06N,H04L

Claim:
1. A system comprising: one or more processors; and a kernel-level security agent including a kernel-mode collector component, configurable filter(s), a routing component, and one or more kernel-mode event consumers, each of the kernel-mode collector component, configurable filter(s), routing component, and one or more kernel-mode event consumers being implemented at the kernel-level wherein: the kernel-mode collector component is configured to be executed by the one or more processors to observe kernel-level events, the configurable filter(s) are configured to be executed by the one or more processors to filter the observed events, including at least the kernel-level events, the routing component is configured to be executed by the one or more processors to route one(s) of the filtered events to one(s) of the one or more kernel-mode event consumers, and the one or more kernel-mode event consumers are configured to be executed by the one or more processors to take action based at least on one of the filtered events.