1
Download SCAN 5-2 Specifications
Transcript
Keeping Protection Up-to-Date Behavior Monitoring Components Behavior Monitoring Driver This kernel mode driver monitors system events and passes them to Behavior Monitoring Core Service for policy enforcement. Behavior Monitoring Core Service This user mode service has the following functions: • Provides rootkit detection • Regulates access to external devices • Protects files, registry keys, and services Behavior Monitoring Configuration Pattern The Behavior Monitoring Driver uses this pattern to identify normal system events and exclude them from policy enforcement. Digital Signature Pattern This pattern contains a list of valid digital signatures that are used by the Behavior Monitoring Core Service to determine whether a program responsible for a system event is safe. Policy Enforcement Pattern The Behavior Monitoring Core Service checks system events against the policies in this pattern. 4-7
