D3FEND 技术详情

D3-OSM

Operating System Monitoring

定义

The operating system software, for D3FEND's purposes, includes the kernel and its process management functions, hardware drivers, initialization or boot logic. It also includes and other key system daemons and their configuration. The monitoring or analysis of these components for unauthorized activity constitute **Operating System Monitoring**.

父技术

D3-PMPlatform Monitoring

子技术

D3-EHBEndpoint Health Beacon D3-IDAInput Device Analysis D3-MBTMemory Boundary Tracking D3-SJAScheduled Job Analysis D3-SDMSystem Daemon Monitoring D3-SFASystem File Analysis D3-SICASystem Init Config Analysis D3-USICAUser Session Init Config Analysis

关联构件

暂无关联构件

语义关系

出向enablesDetect

出向kb referenceReference - Host intrusion prevention system using software and user behavior analysis - Sophos Ltd

出向kb referenceReference - CAR-2016-04-002: User Activity from Clearing Event Logs - MITRE