Kernel-Level Event Logging for ICS Data Provenance and Threat Detection

The patent introduces a logging agent as an intermediary component that operates at the user space level to capture and log kernel-level events. This agent acts as a mediator between the kernel space and the analysis system, allowing detailed security monitoring without requiring direct kernel modification or increasing kernel space complexity. The logging agent intercepts and records events such as process creation, file access, and network connections, providing comprehensive security visibility while maintaining system architecture simplicity.

The patent implements selective logging of only relevant security-critical events rather than monitoring all kernel events. The logging agent filters and captures specific events such as process creation, file system access, registry modifications, and network connections that are most indicative of security threats. This partial monitoring approach enables real-time threat detection while significantly reducing processing overhead and resource consumption compared to comprehensive event logging.

The patent applies different logging strategies to different event types and system components based on their security relevance. Critical security events such as process creation, file access to sensitive resources, and network connections are logged with high detail including timestamps, process identifiers, and contextual information. Less critical events are logged with reduced detail or not logged at all. This differentiated logging approach ensures complete forensic information for security-relevant events while minimizing overall data volume and storage requirements.