Techniques for generating unique identifiers for tracking process activity

Patent metadata

Field	Value
Publication number	US-12339786-B2
Application number	US-202218081149-A
Country	US
Kind code	B2
Filing date	Dec 14, 2022
Priority date	Dec 14, 2022
Publication date	Jun 24, 2025
Grant date	Jun 24, 2025

Abstract

A method includes retrieving, in a kernel space of an operating system executing on a computing device, a first value from a first clock source, retrieving, in a user space of the operating system executing on the computing device, a second value from a second clock source, generating a unique process identifier (UPID) associated with a process identifier (PID) of a process executing in the operating system, wherein the UPID is based on the first value of the first clock source and the second value of the second clock source, and tracking process activity of the process executing in the operating system by utilizing the UPID.

First claim

What is claimed is:

1. A method comprising:
retrieving, in a kernel space of an operating system executing on a computing device, a first value from a first clock source;
retrieving, in a user space of the operating system executing on the computing device, a second value from a second clock source, wherein the retrieving the second value of the second clock source is performed periodically;
updating a seed within a seed store based on the second value of the second clock source;
generating, by a processing device, a unique process identifier (UPID) associated with a process identifier (PID) of a process executing in the operating system, wherein the UPID is based on the first value of the first clock source and the second value of the second clock source; and
tracking process activity of the process executing in the operating system by utilizing the UPID.

2. The method of claim 1 , further comprising:
determining if the UPID is present in a least recently used (LRU) map of the operating system; and
responsive to determining that the UPID is present in the LRU map:
retrieving, in the kernel space of the operating system, a third value from the first clock source; and
generating an additional UPID based on the third value of the first clock source and the second value of the second clock source.

3. The method of claim 1 , wherein updating the seed within the seed store based on the second value of the second clock source comprises:
retrieving, in the user space of the operating system, a third value from the second clock source; and
updating the seed within the seed store based on a difference between the second value and the third value from the second clock source.

4. The method of claim 1 , wherein generating the UPID comprises generating a sum of the first value of the first clock source and the seed.

5. The method of claim 1 , wherein the seed store comprises a memory structure shared between the kernel space and the user space of the operating system, and
wherein the UPID is generated by an application extension executing in an extended Berkeley packet filter (eBPF) infrastructure within the operating system of the computing device.

6. The method of claim 1 , further comprising:
retrieving a processing device index from the processing device; and
generating the UPID further based on the processing device index.

7. A system comprising:
a memory; and
a processing device, operatively coupled to the memory, to:
retrieve, in a kernel space of an operating system executing on a computing device, a first value from a first clock source;
retrieve, in a user space of the operating system executing on the computing device, a second value from a second clock source, wherein the retrieval of the second value of the second clock source is performed periodically;
update a seed within a seed store based on the second value of the second clock source;
generate a unique process identifier (UPID) associated with a process identifier (PID) of a process executing in the operating system, wherein the UPID is based on the first value of the first clock source and the second value of the second clock source; and
track process activity of the process executing in the operating system by utilizing the UPID.

8. The system of claim 7 , wherein the processing device is further to:
determine if the UPID is present in a least recently used (LRU) map of the operating system; and
responsive to determining that the UPID is present in the LRU map:
retrieve, in the kernel space of the operating system, a third value from the first clock source; and
generate an additional UPID based on the third value of the first clock source and the second value of the second clock source.

9. The system of claim 7 , wherein to update the seed within the seed store based on the second value of the second clock source the processing device is to:
retrieve, in the user space of the operating system, a third value from the second clock source; and
update the seed within the seed store based on a difference between the second value and the third value from the second clock source.

10. The system of claim 7 , wherein to generate the UPID the processing device is to generate a sum of the first value of the first clock source and the seed.

11. The system of claim 7 , wherein the seed store comprises a memory structure shared between the kernel space and the user space of the operating system, and
wherein the UPID is generated by an application extension executing in an extended Berkeley packet filter (eBPF) infrastructure within the operating system of the computing device.

12. The system of claim 8 , wherein the processing device is further to:
retrieve a processing device index from the processing device; and
generate the UPID further based on the processing device index.

13. A non-transitory computer-readable storage medium including instructions that, when executed by a processing device, cause the processing device to:
retrieve, in a kernel space of an operating system executing on a computing device, a first value from a first clock source;
retrieve, in a user space of the operating system executing on the computing device, a second value from a second clock source, wherein the retrieval of the second value of the second clock source is performed periodically;
update a seed within a seed store based on the second value of the second clock source;
generate a unique process identifier (UPID) associated with a process identifier (PID) of a process executing in the operating system, wherein the UPID is based on the first value of the first clock source and the second value of the second clock source; and
track process activity of the process executing in the operating system by utilizing the UPID.

14. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions further cause the processing device to:
determine if the UPID is present in a least recently used (LRU) map of the operating system; and
responsive to determining that the UPID is present in the LRU map:
retrieve, in the kernel space of the operating system, a third value from the first clock source; and
generate an additional UPID based on the third value of the first clock source and the second value of the second clock source.

15. The non-transitory computer-readable storage medium of claim 13 , wherein to update the seed within the seed store based on the second value of the second clock source the processing device is to:
retrieve, in the user space of the operating system, a third value from the second clock source; and
update the seed within the seed store based on a difference between the second value and the third value from the second clock source.

16. The non-transitory computer-readable storage medium of claim 13 , wherein to generate the UPID the processing device is to generate a sum of the first value of the first clock source and the seed.

17. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions further cause the processing device to:
retrieve a processing device index from the processing device; and
generate the UPID further based on the processing device index.

Assignees

• Crowdstrike Inc

Inventors

• Kelly Martin
• Vedovati Marco
• Polevoy Igor
• Petrbok Milos
• White Christopher

Classifications

• G06F9/544

  Buffers; Shared memory; Pipes · CPC title

• G06F1/14 Primary

  Time supervision arrangements, e.g. real time clock · CPC title

• G06F2212/1008

  Correctness of operation, e.g. memory ordering · CPC title

• G06F12/1491

  in a hierarchical protection system, e.g. privilege levels, memory rings · CPC title

• G06F11/3466

  Performance evaluation by tracing or monitoring · CPC title