Integrity assurance and rebootless updating during runtime
Techniques are described herein for, without rebooting a computing device, unloading at least a component of a kernel-mode component of the computing device and loading an updated version of the component of the kernel-mode component. The techniques may be performed by an integrity manager associated with the kernel-mode component. The integrity manager may also determine integrity of the kernel-mode component by causing the kernel-mode component to perform an action associated with a known reaction, determining whether the known reaction occurred, and in response, performing a remediation action or notifying a remote security service. Further, the integrity manager may determine whether any computing device lists include representations of components or connections associated with the kernel-mode component. The integrity manager may then remove the representations from the lists or remove the representations from responses to requests for contents of the computing device lists.
1. A computing device comprising:
a processor; and
memory storing:
a kernel-mode component of a security agent, the kernel-mode component being configured to be operated by the processor to:
monitor events that occur on the computing device; and
provide information associated with the events to a remote security service; and
an integrity manager associated with the kernel-mode component, the integrity manager being configured to be operated by the processor to:
register an operating system hook on behalf of the kernel-mode component;
receive, via the operating system hook, the events that occur on the computing device;
provide the events to the kernel-mode component for processing; and
determine an integrity of the kernel-mode component by:
causing the kernel-mode component to perform an action associated with generation of an event on the computing device, wherein the integrity manager is configured to capture the event via the operating system hook;
determining that the event was not generated, or was not processed, in response to the action of the kernel-mode component; and
in response to determining that the event was not generated, or was not processed, performing at least one of a remediation action or notifying the remote security service associated with the kernel-mode component.
2. The computing device of claim 1 , wherein the integrity manager is further configured to:
determine that the kernel-mode component is inactive; and
perform the determining of the integrity of the kernel-mode component responsive to determining that the kernel-mode component is inactive.
3. The computing device of claim 1 , wherein the integrity manager is configured to:
perform a first remediation action or send a first notification to the remote security service in response to determining that the event was generated but was not processed, and
perform a second remediation action or send a second notification to the remote security service in response to determining that the event was not generated.
4. The computing device of claim 1 , wherein the remediation action includes one of:
generating a new worker thread,
flushing an event queue,
registering a new operating system hook, or
resetting or reloading the kernel-mode component without rebooting the computing device.
5. The computing device of claim 1 , wherein the integrity manager is further configured to:
determine that an integrity of a data store associated with the kernel-mode component has been compromised; and
in response to determining that the integrity of the data store has been compromised, perform at least one of:
deleting data from the data store, or
saving a saved state of the data store, creating a new data store, and initializing the new data store based on the saved state.
6. The computing device of claim 1 , wherein the integrity manager is further configured to determine the integrity of the kernel-mode component by:
detecting an occurrence of a system action on the computing device, wherein the system action is associated with generation of a second event;
determining that the second event was not generated, or was not processed, in response to the occurrence of the system action; and
in response to determining that the second event was not generated, or was not processed, performing at least one of the remediation action or the notifying the remote security service.
7. The computing device of claim 5 , wherein the data store is a situational model that tracks at least one of attributes, patterns, or behaviors associated with applications or processes executing on the computing device.
8. The computing device of claim 1 , wherein the event is associated with the kernel-mode component writing a registry key.
9. A computer-implemented method comprising:
registering, by an integrity manager associated with a kernel-mode component of a security agent executing on a computing device, an operating system hook on behalf of the kernel-mode component, wherein registering the operating system hook causes the integrity manager to:
receive, via the operating system hook, events that occur on the computing device; and
provide the events to the kernel-mode component for processing;
determining, by the integrity manager, an integrity of the kernel-mode component by:
causing the kernel-mode component to perform an action associated with generation of an event on the computing device, wherein the integrity manager is configured to capture the event via the operating system hook;
determining that the event was not generated, or was not processed, in response to the action of the kernel-mode component; and
in response to determining that the event was not generated, or was not processed, performing at least one of a remediation action or notifying a remote security service associated with the kernel-mode component,
wherein the kernel-mode component of the security agent is configured to:
monitor the events that occur on the computing device, and
provide information associated with the events to the remote security service.
10. The computer-implemented method of claim 9 , further comprising:
determining, by the integrity manager, that the kernel-mode component is inactive,
wherein the integrity manager determines the integrity of the kernel-mode component responsive to determining that the kernel-mode component is inactive.
11. The computer-implemented method of claim 9 , wherein the remediation action includes one of:
generating a new worker thread,
flushing an event queue,
registering a new operating system hook, or
resetting or reloading the kernel-mode component without rebooting the computing device.
12. The computer-implemented method of claim 9 , further comprising:
determining, by the integrity manager, that an integrity of a data store associated with the kernel-mode component has been compromised; and
in response to determining that the integrity of the data store has been compromised, performing, by the integrity manager, at least one of:
deleting data from the data store, or
saving a saved state of the data store, creating a new data store, and initializing the new data store based on the saved state.
13. The computer-implemented method of claim 9 , wherein performing the at least one of the remediation action or notifying the remote security service comprises:
performing a first remediation action or sending a first notification to the remote security service in response to determining that the event was generated but was not processed, and
performing a second remediation action or sending a second notification to the remote security service in response to determining that the event was not generated.
14. The computer-implemented method of claim 9 , further comprising:
detecting an occurrence of a system action on the computing device, wherein the system action is associated with generation of a second event;
determining that the second event was not generated, or was not processed, in response to the occurrence of the system action; and
in response to determining that the second event was not generated, or was not processed, performing at least one of the remediation action or the notifying the remote security service.
15. One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors of a computing device, cause the one or more processors to perform operations comprising:
registering, by an integrity manager associated with a kernel-mode component of a security agent executing on the computing device, an operating system hook on behalf of the kernel-mode component, wherein registering the operating system hook causes the integrity manager to:
receive, via the operating system hook, events that occur on the computing device; and
provide the events to the kernel-mode component for processing;
determining, by the integrity manager, an integrity of the kernel-mode component by:
causing the kernel-mode component to perform an action associated with generation of an event on the computing device, wherein the integrity manager is configured to capture the event via the operating system hook;
determining that the event was not generated, or was not processed, in response to the action of the kernel-mode component; and
in response to determining that the event was not generated, or was not processed, performing at least one of a remediation action or notifying a remote security service associated with the kernel-mode component,
wherein the kernel-mode component of the security agent is configured to:
monitor the events that occur on the computing device, and
provide information associated with the events to the remote security service.
16. The one or more non-transitory computer-readable media of claim 15 , wherein the operations further comprise:
determining, by the integrity manager, that the kernel-mode component is inactive,
wherein the integrity manager determines the integrity of the kernel-mode component responsive to determining that the kernel-mode component is inactive.
17. The one or more non-transitory computer-readable media of claim 15 , wherein the computer-executable instructions cause the integrity manager to:
perform a first remediation action or send a first notification to the remote security service in response to determining that the event was generated but was not processed, and
perform a second remediation action or send a second notification to the remote security service in response to determining that the event was not generated.
18. The one or more non-transitory computer-readable media of claim 15 , wherein the operations further comprise:
determining, by the integrity manager, that an integrity of a data store associated with the kernel-mode component has been compromised; and
in response to determining that the integrity of the data store has been compromised, performing at least one of:
deleting, by the integrity manager, data from the data store, or
saving, by the integrity manager, a saved state of the data store, creating, by the integrity manager, a new data store, and initializing, by the integrity manager, the new data store based on the saved state.
19. The one or more non-transitory computer-readable media of claim 15 , wherein the remediation action includes one of:
generating a new worker thread,
flushing an event queue,
registering a new operating system hook, or
resetting or reloading the kernel-mode component without rebooting the computing device.
20. The one or more non-transitory computer-readable media of claim 15 , wherein the operations further comprise:
detecting an occurrence of a system action on the computing device, wherein the system action is associated with generation of a second event;
determining that the second event was not generated, or was not processed, in response to the occurrence of the system action; and
in response to determining that the second event was not generated, or was not processed, performing at least one of the remediation action or the notifying the remote security service.