Specifications

Keeping Protection Up-to-Date
4-7
Behavior Monitoring Components
Behavior Monitoring Driver
This kernel mode driver monitors system events and passes them to Behavior
Monitoring Core Service for policy enforcement.
Behavior Monitoring Core Service
This user mode service has the following functions:
• Provides rootkit detection
• Regulates access to external devices
• Protects files, registry keys, and services
Behavior Monitoring Configuration Pattern
The Behavior Monitoring Driver uses this pattern to identify normal system events and
exclude them from policy enforcement.
Digital Signature Pattern
This pattern contains a list of valid digital signatures that are used by the Behavior
Monitoring Core Service to determine whether a program responsible for a system
event is safe.
Policy Enforcement Pattern
The Behavior Monitoring Core Service checks system events against the policies in this
pattern.