Ai-powered virus scanning with predictive threat anticipation, context-aware retroactive threat analysis, and adaptive malware deception

Abstract

Technology for predictive cybersecurity threat detection that includes receiving, at one or more computing devices, multimodal data related to user activities, network traffic, and system operations associated with a computer system. The method further includes analyzing, by at least one agentic vision‑language model (VLM) executing on the computing devices, the multimodal data to determine that at least a portion of the data represents a cybersecurity threat to the computer system. The agentic VLM is trained to predict cybersecurity threats by analyzing temporal patterns in the multimodal data across multiple time periods. In response to determining that at least a portion of the multimodal data represents a cybersecurity threat, the method includes initiating one or more actions configured to mitigate the detected threat.

Description

[0001] Attorney Docket No.: 59103-0006W01

[0002] Al-Powered Virus Scanning with Predictive Threat Anticipation, Context- Aware Retroactive Threat Analysis, and Adaptive Malware Deception

[0003] PRIORITY CLAIM

[0004] This application claims priority to U.S. Provisional Application 63 / 747 ,785, filed on January 21, 2025, the entire content of which is incorporated herein by reference.

[0005] TECHNICAL FIELD

[0006] The technology described herein relates to cyber security and, more specifically, to advanced systems and methods for detecting, analyzing, and mitigating cyber security threats using generative large language models.

[0007] BACKGROUND

[0008] Some antivirus solutions rely on signature-based detection and heuristic analysis, which are insufficient against rapidly evolving cyber threats such as zero-day exploits, polymorphic malware, and advanced persistent threats (APTs). These systems may lack the capacity for realtime adaptation, predictive defense, and retroactive analysis of attack patterns.

[0009] Moreover, centralized cyber security systems face growing challenges with data privacy and compliance, especially in regulated industries. Some solutions cannot efficiently scale threat detection across diverse systems while maintaining user privacy and adaptive learning.

[0010] SUMMARY

[0011] Disclosed herein is a computer-implemented method for predictive cybersecurity threat detection that includes receiving, at one or more computing devices, multimodal data related to user activities, network traffic, and system operations associated with a computer system. The method further includes analyzing, by at least one agentic vision-language model (VLM) executing on the computing devices, the multimodal data to determine that at least a portion of the data represents a cybersecurity threat to the computer system. The agentic VLM is trained to predict cybersecurity threats by analyzing temporal patterns in the multimodal data across multiple time periods. In response to determining that at least a portion of the multimodal dataAttorney Docket No.: 59103-0006W01

[0012] represents a cybersecurity threat, the method includes initiating one or more actions configured to mitigate the detected threat.

[0013] In various embodiments, the multimodal data includes one or more of telemetry data associated with the computer system, behavioral analytics, biometric data, file metadata, and global threat intelligence. The one or more computing devices and the computer system may be connected over a local area network, may be part of the same computer system, or may operate within a common trusted execution environment (TEE).

[0014] The agentic VLM may be trained to generate multiple embeddings based on the multimodal data, and threat detection may be based on analyzing these embeddings. The agentic VLM may further be configured to preemptively identify cybersecurity threats prior to the threats causing compromise to the computer system.

[0015] The mitigation actions may include isolating the detected cybersecurity threat into a portion of the computer system. This portion of the system may simulate an environment configured to be affected by the cybersecurity threat, and the computing devices may track the threat within the environment. Training of the agentic VLM may be updated based on the tracking performed within the simulated environment. In some implementations, the simulated environment is generated in response to identifying that a trigger condition associated with activation of the cybersecurity threat has been satisfied.

[0016] The agentic VLM may be trained using federated learning. The mitigation actions may include dynamically adjusting security controls. Adjusting the security controls may include one or more of deploying software patches, modifying firewall rules, quarantining compromised devices, or isolating suspicious network segments.

[0017] Further disclosed is a system including one or more computers and one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the computers to perform operations including any of the methods described above. Also disclosed are one or more non-transitory computer-readable storage media encoded with computer program instructions that, when executed by one or more computers, cause the computers to perform operations including any of the methods described above.

[0018] The technology described in this specification can be implemented so as to realize one or more of the following advantages.

[0019] In some implementations, the technologies described herein improve the proactiveAttorney Docket No.: 59103-0006W01

[0020] security of a system. The PTAE forecasts threats, enabling preemptive action. Unlike signaturebased methods, which rely on patterns of known malware signatures, the PTAE model can forecast unknown threats, which reduce manual updates.

[0021] In some implementation, the technologies described herein improve comprehensive detection. The CARTA retroactively detects threats missed by traditional methods. The historical analysis of multimodal embeddings provides context to anomalies detected over multiple time resolutions unlike typical malware databases which do not have APTs or multiple modalities. The technologies described herein enable advanced malware analysis. The AMDN isolates and analyzes sophisticated malware in adaptive sandbox environments. This achieves the previously difficult task gathering evidence and multimodal telemetry information. AMDN simulates realistic environments more effectively than some cyber honeypots.

[0022] In some implementations, the technologies described herein enable continuous improvement of a threat detection system using federated learning techniques. Federated learning allows the system to evolve without sacrificing data privacy. The models continuously update and share local insights providing more comprehensive and more efficient malware updates.

[0023] Overall, the integrated system represents a significant advancement in cyber security by combining real- time detection, predictive defense, and adaptive mitigation within a secure and scalable architecture. The autonomous extraction of security insights is achieved from leveraging artificial intelligence (Al) models to learn from both from internal and external environments over multiple modalities and timescales. When these insights are combined with the ability to act on the system and share insights globally, the underlying technology of cybersecurity threat detection is improved significantly.

[0024] BRIEF DESCRIPTION OF THE DRAWINGS FIG. l is a block diagram of an example threat detection system.

[0025] FIG. 2 is a block diagram illustrating a data flow by which data and updates are communicated throughout a threat detection system.

[0026] FIG. 3 is a block diagram illustrating an operational workflow for threat detection and adaptive mitigation.

[0027] FIG. 4 is a block diagram illustrating communications orchestrated by a Federated Learning Module of a threat detection system.Attorney Docket No.: 59103-0006W01

[0028] FIG. 5 is a flowchart of an example process executed by a threat detection system in accordance with technology described herein.

[0029] FIG. 6 shows block diagrams of example computing devices.

[0030] Like reference numbers and designations in the various drawings indicate like elements.

[0031] DETAILED DESCRIPTION

[0032] The technology described herein is directed to artificial intelligence (Al)-powered virus scanning, which integrates advanced generative models with dynamic cyber security tools to provide real-time threat detection, predictive defense, and adaptive mitigation. The system also employs privacy-preserving federated learning to enhance global threat intelligence without compromising user data privacy.

[0033] In some implementations, the technology includes a Predictive Threat Anticipation Engine (PTAE) module, which utilizes a localized mini Vision Language Model (mini VLM) to process multimodal data in real-time. This data includes system telemetry, user behavior analytics, network flow data, and external threat intelligence feeds. In some implementations, the PTAE includes hierarchical temporal embeddings, designed to model both micro-level (shortterm) and macro-level (long- term) behavioral patterns across systems and users. This embedding strategy allows the PTAE to detect subtle anomalies that signal the early stages of complex attacks, such as slow-moving data exfiltration or privilege escalation typical of Advanced Persistent Threats (APTs).

[0034] In some implementations, to support adaptive learning, the PTAE continuously refines its detection models through reinforcement learning algorithms that evaluate the success of past mitigation actions. This feedback loop enables the system to prioritize and evolve its response strategies, enhancing its ability to neutralize both known and novel threats without manual oversight. Furthermore, the PTAE is integrated with privacy-preserving federated learning, allowing it to aggregate model improvements from multiple decentralized nodes without exposing raw data.

[0035] Complementing the PTAE’s predictive capabilities, implementations of the technology includes a Context-Aware Retroactive Threat Analysis (CARTA) module that introduces a powerful forensic analysis engine that retroactively scans historical system data for previouslyAttorney Docket No.: 59103-0006W01

[0036] undetected threats. CARTA employs temporal correlation mapping and sequence modeling to reconstruct the full lifecycle of multi-stage attacks. In some implementations, CARTA is configured to use adaptive causal inference models, which identify cause-and-effect relationships between isolated system events. This capability allows CARTA to detect hidden connections between seemingly unrelated anomalies — such as correlating a minor file access anomaly months ago with recent suspicious outbound network activity — revealing stealthy, long-term attack campaigns. CARTA also integrates adaptive anomaly scoring algorithms that dynamically adjust risk scores for past events based on emerging threat intelligence. This scoring system is powered by a dual-layer neural network architecture that simultaneously evaluates behavioral deviations and environmental context, significantly reducing false positives while improving sensitivity to low- and-slow attack techniques. Additionally, CARTA could leverage synthetic data to simulate historical attack scenarios, enhancing its ability to uncover novel threat patterns and adapt to evolving attack strategies.

[0037] In some implementations, the technology includes an Adaptive Malware Deception Network (AMDN) module that can be configured to isolate a cybersecurity threat into a particular portion of the underlying system of network. This portion can be referred to as a sandbox, and configured to simulate an environment the threat or malware is likely to attack. The sandbox environment can be used to allow the malware to carry out its functions within the isolated portion, which in turn can be tracked to glean information on the malware to update the trained model(s). In some implementations, the AMDN can include an Adaptive Trigger Mechanism, which dynamically modifies sandbox parameters to expose malware designed to activate under specific conditions. By altering system configurations, network responses, and user behavior patterns in real-time, AMDN can provoke condition-based malware into revealing its full execution flow. This is complemented by real-time behavioral analysis, where AMDN monitors system calls, memory manipulation, process injection, and network communications, for example, using a hybrid static-dynamic analysis model. This allows the system to extract detailed Indicators of Compromise (IOCS) and generate real-time behavioral signatures for immediate threat mitigation. Once a malware specimen is fully analyzed, AMDN automatically engages in threat containment and intelligence dissemination. This involves isolating the malicious code, generating custom detection signatures, and securely sharing anonymized threat intelligence across federated learning models. This collaborative defense model increases aAttorney Docket No.: 59103-0006W01

[0038] likelihood that all participating nodes are fortified against emerging threats without compromising sensitive internal data. By integrating predictive analytics, retroactive detection, and adaptive deception, the technology described herein establishes a self-sustaining cybersecurity framework capable of autonomously identifying, neutralizing, and learning from advanced cyber threats. The synergy between the PTAE, CARTA, and AMDN creates a defense ecosystem that continuously evolves, ensuring comprehensive protection across a cyberattack lifecycle.

[0039] FIG. 1 is a block diagram of an example threat detection system 100. The system 100 includes at least five components including: a virus scanner 102 such as a generative Al scanner, which can be implemented using a local large language model (LLM) agent; a predictive threat anticipation engine (PTAE) 104; a context-aware retroactive threat analysis (CARTA) engine 106; and an adaptive malware deception network (AMDN) 108. In some implementations, one or more of the above engines and models can be trained using a privacy-preserving federated learning module.

[0040] The Generative Al Virus Scanner 102 is powered by a lightweight, locally deployed Agentic Vision Language Model (VLM) to seamlessly integrate with other virus scanning tools, transforming traditional cybersecurity methods into adaptive, intelligent defenses. By using the locally deployed Agentic VLM, the generative Al virus scanner 102 harnesses advanced multimodal data processing capabilities to analyze a diverse range of data inputs, such as realtime and historical file behaviors, user activity patterns, system logs, and network traffic. By synthesizing and contextualizing these varied data streams, the generative Al virus scanner 102 develops a multi-step reasoning comprehensive understanding of system operations, enabling it to detect subtle anomalies and emerging threats that traditional scanners often overlook. The ability of the generative Al virus scanner 102 to interpret complex relationships between different data modalities allows for precise identification of malicious behaviors, reducing false positives while enhancing detection accuracy. Operating offline within the local environment, the generative Al virus scanner 102 can increase the likelihood of rapid, autonomous threat detection and mitigation without relying on external servers, preserving data privacy and significantly decreasing response times. Through continuous learning from local data, the generative Al virus scanner 102 evolves to counteract sophisticated cyber threats, proactively adapting to new malware signatures and attack strategies in real time.Attorney Docket No.: 59103-0006W01

[0041] The generative AT virus scanner 102 can be configured to scan files and system activity for malicious patterns in real time. The generative Al virus scanner 102 can perform multimodal analysis for comprehensive threat detection. For example, the multimodal analysis can include analysis of one or more of: text, images, behavior, or biometrics. In some implementations, the generative Al virus scanner 102 operates on a device that is part of the same network or computer system that the threat detection system 100 is implemented to protect, helping to reduce latency, enhance privacy, or both. In some implementations, the generative Al virus scanner 102 uses a risk-based human escalation protocol with interactive dialogue for real time high-priority threats that may require human intervention.

[0042] The generative Al virus scanner 102 can provide system activity data 114 in real-time to the PTAE 104 for predictive analysis. The generative Al virus scanner 102 can supply historical data 110, including historical logs and behavior data, to the CARTA engine 106 for retroactive scanning. The generative Al virus scanner 102 can work with the AMDN 108 to analyze malware in dynamic environments. For example, the generative Al virus scanner 102 can transmit a trigger 112 to the AMDN 108 in response to detecting malicious patterns in files and system activity. The generative Al virus scanner 102 can merge local encrypted updates to a central system of the Federated Learning Module while maintaining strict data privacy and security.

[0043] In some implementations, the PTAE 104 includes a LLM Virus Scanner (“Agentic Virus Scanner”), which employs a lightweight, localized Al Agentic framework to dynamically manage and optimize virus scanning tools. The Agentic Virus Scanner incorporates a diverse range of models. For example, the models incorporated by the Agentic Virus Scanner can include mini vision-language models (mini VLMs) that specialize in processing and interpreting multimodal data, such as combining visual and textual inputs for nuanced understanding. This feature transformation enhances traditional malware detection by enabling context-aware, adaptive, and autonomous threat detection and mitigation in real time. In some implementations, the PTAE 104 can include localized Al Agents with mini VLM technology that operate directly within the system’s security environment.

[0044] Because the PTAE 104 can operate on a device that is part of the network that is being protected, latency and dependency on external servers can be reduced, allowing for real- time, offline malware detection. Each Al Agent continuously learns from system behavior and localAttorney Docket No.: 59103-0006W01

[0045] threat data, enabling it to anticipate and neutralize malware with speed and precision. The Agentic Virus Scanner serves as an intelligent command hub for existing virus scanning tools, dynamically adjusting their focus and scanning parameters based on detected anomalies. By leveraging deep contextual understanding, each mini VLM agent can be configured to prioritize high-risk areas for intensive scanning, optimize resource allocation, and reduce false positives.

[0046] In some implementations, the PTAE 104 integrates the Al Agents with multimodal data fusion, combining system telemetry, behavioral analytics, file metadata, and global threat intelligence to proactively predict and intercept malware before it can cause harm. Each Al Agent interprets patterns across multiple data types, allowing it to recognize complex, evolving malware tactics. Each Al Agent continuously learns and adapts to new malware techniques through reinforcement learning. Each Al agent refines its decision-making by analyzing the success of past threat mitigations and updating its virus detection models in real-time. This adaptive capability allows the PTAE 104 to stay ahead of emerging malware variants and sophisticated attack strategies. Detecting a threat, the Agentic Virus Scanner can flag it, and additionally autonomously initiate contextual mitigation. Depending on the threat severity, the mini VLM can trigger actions such as quarantining files, terminating processes, blocking network connections, or dynamically updating firewall rules.

[0047] In some implementations, the PTAE 104 leverages real-time behavioral analytics to continuously monitor user activities, network traffic, and system operations. This analysis identifies deviations from normal behavior, flagging potential soft spots in security, compromised accounts, or anomalous processes. By detecting subtle behavioral shifts, the PTAE 104 can recognize early warning signs of malicious intent that traditional systems might overlook. Additionally, the PTAE 104 integrates global threat intelligence feeds, which provide up-to-date information on emerging cyber threats, known vulnerabilities, malware signatures, and attack vectors. These feeds are sourced from cyber security research labs, industry databases, and security vendors, increasing a likelihood that the PTAE 104 stays informed about the latest tactics, techniques, and procedures (TTPs) used by cyber criminals. This contextual data enriches the engine’s understanding of evolving threats, enabling it to correlate internal anomalies with external threat landscapes. The PTAE 104 also employs sophisticated time-series modeling and machine learning algorithms to analyze historical data and predict future attack patterns. This modeling captures temporal trends and recurring attack behaviors, allowing the system toAttorney Docket No.: 59103-0006W01

[0048] forecast potential threats based on past incidents and seasonal attack cycles. By understanding how certain attack types unfold over time, the PT E 104 can anticipate when and where vulnerabilities might be exploited.

[0049] The PTAE 104 is able to integrate system telemetry data such as log fdes, access records, and network flow data with external global threat signals. This multimodal data fusion enables the engine to build a comprehensive risk profile for systems and users. For example, the PTAE 104 can correlate unusual login behavior with known phishing campaigns or detect malware-infected devices attempting to communicate with command-and- control servers. In some implementations, the PTAE 104 operates in real-time or near-real-time, continuously updating its threat models as new data becomes available. The predictive capabilities of the PTAE 104 can allow a system using the PTAE 104 to implement preemptive security measures, such as adjusting firewall rules, isolating suspicious devices, or updating access controls before an attack can escalate. This proactive defense significantly reduces the time between threat detection and response, closing security gaps and mitigating risks. By combining behavioral analytics, global threat intelligence, and predictive modeling, the PTAE 104 offers a holistic and adaptive cyber security solution. For example, the PTAE 104 can allow a system using the PTAE 104 to stay ahead of sophisticated cyber adversaries by not only detecting threats as they happen but anticipating and neutralizing them before they can inflict damage.

[0050] The PTAE 104 leverages advanced multimodal data fusion to continuously monitor and analyze diverse data streams, including system logs, network traffic, file access patterns, user behavior, biometric data, and device telemetry. Using custom multimodal embeddings generated by the integrated mini VLMs, the system can detect subtle, context-aware indicators of malicious activity that traditional signature-based systems overlook. This holistic approach enables the detection of complex, multi-vector attacks such as insider threats, coordinated phishing campaigns, and ransomware propagation. For example, suspicious file modifications combined with anomalous login times and unauthorized access to sensitive directories can trigger the system to flag potential insider threats.

[0051] In some implementations, the PTAE 104 employs an agentic framework to perform advanced time-series analysis on historical and current data. This allows the system to identify temporal patterns, analyze patterns across different time scales (hourly, daily, seasonal) and anticipate system vulnerabilities before they can be exploited. The model continuously adapts itsAttorney Docket No.: 59103-0006W01

[0052] forecasting accuracy through reinforcement learning, enabling predictive detection of zero-day exploits and evolving malware tactics. For example, by analyzing seasonal trends in phishing campaigns and user login behaviors through recurrent-based neural networks or tree-based models, the PTAE 104 can predict when specific systems, e.g., corresponding to different departments or entities, are vulnerable and increase monitoring during high-risk periods.

[0053] In some implementations, upon detecting or predicting potential threats, the PTAE 104 autonomously executes context-aware, preemptive mitigation actions. Powered by the Agentic Virus Scanner, the system dynamically adjusts security controls, such as deploying software patches, modifying firewall rules, quarantining compromised devices, or isolating suspicious network segments. This adaptive response system significantly reduces reaction time and limits the window of opportunity for attackers. For example, if the Al Agents identify suspicious data exfiltration attempts, they can automatically throttle network traffic from the affected endpoint, block outbound connections, and trigger security alerts, all without human intervention.

[0054] In some implementations, the PTAE 104 enhances situational awareness by integrating live threat intelligence feeds from sources such as common vulnerabilities and exposures (CVE) databases, malware signature repositories, global security advisories, and even dark web monitoring tools. This real-time intelligence is fused with internal telemetry to provide a comprehensive threat landscape view. The mini VLM technology in the Al Agents dynamically prioritizes and contextualizes this information to adapt defenses against new and evolving threats. For example, when a new exploit is reported in a CVE feed targeting unpatched software, the PTAE 104 can cross-reference system inventories, prioritize patch deployment, and restrict access to vulnerable services.

[0055] In some implementations, upon detecting a new suspicious pattern, the agentic Virus Scanner initiates a two-step process. First, the Agent compiles its findings into a human-readable format, including supporting evidence. In the second step, potentially based on human feedback, the finding is either confirmed or rejected. If confirmed, the pattern is incorporated into the agent's detection ruleset with appropriate weighting in real time. If rejected, the pattern is not incorporated into the agent’s detection ruleset. Agents use reward modeling from human validation to optimize their detection policy, employing techniques like DPO (Direct Preference Optimization) or Reinforcement Learning with Human Feedback (RLHF) to maintain stable learning while incorporating expert feedback.Attorney Docket No.: 59103-0006W01

[0056] In some implementations, the PTAE 104 serves as an advanced cybersecurity solution that leverages continuous behavioral analysis and external threat intelligence to proactively forecast and mitigate emerging cyber threats. By monitoring system behavior in real time and identifying subtle deviations from normal operational patterns, the PTAE 104 can detect early indicators of potential vulnerabilities that might otherwise go unnoticed. This engine synthesizes internal data — such as user activity, application performance, and network behavior — with external threat intelligence feeds, allowing it to construct a dynamic threat landscape. Through this comprehensive integration, the PTAE 104 anticipates likely attack vectors and adapts its detection models to recognize evolving tactics, techniques, and procedures (TTPs) used by cyber adversaries. Its predictive capabilities enable it to recommend and even initiate preemptive security measures, such as patching vulnerabilities, updating firewall rules, or isolating high-risk assets, thereby neutralizing threats before they can exploit system weaknesses. By functioning autonomously and continuously refining its predictive models through machine learning, the PTAE 104 significantly reduces the window of opportunity for attackers, strengthening the organization’s defense posture against sophisticated and previously unknown cyber threats.

[0057] In some implementations, the PTAE 104 can employ temporal analysis. Employing temporal analysis can include utilizing time-series modeling to detect anomalous trends in user behavior, file access, and network traffic. In some implementations, the PTAE 104 can employ threat intelligence integration. Employing threat intelligence integration can include ingesting external data from CVE databases, possible dark web monitoring, and global threat feeds. In some implementations, the PTAE 104 can employ dynamic risk scoring. Employing dynamic risk scoring can include assigning risk scores to system components, adjusting defenses in real time, or both. In some implementations, the PTAE 104 can include an adaptive insights dashboard. The adaptive insights dashboard can be used to report attack patterns in simple terms with customizable timeframes and severity thresholds.

[0058] In some implementations, the PTAE 104 can continuously monitor data streams from the Generative Al Agentic Virus Scanner 102. The PTAE 104 can automatically trigger defense actions, such as patch deployment, firewall adjustments, or endpoint isolation. For example, the PTAE 104 can transmit one or more triggers 116 to the AMDN 108. In some implementations, the PTAE 104 can share predictive insights with the Federated Learning Module to update a global threat model. As an example scenario, if abnormal login patterns are detected acrossAttorney Docket No.: 59103-0006W01

[0059] multiple endpoints, the PTAE 104 can forecast a possible ransomware attack and preemptively strengthen network segmentation and access controls.

[0060] The Context- Aware Retroactive Threat Analysis (CARTA) engine 106 can be designed to perform in-depth, intelligent examination of historical system data to uncover hidden or previously undetected threats. Unlike some conventional security systems that focus solely on real-time detection, the CARTA engine 106 extends protection by continuously mining past activity for signs of sophisticated, stealthy attacks. This retrospective analysis can decrease a likelihood that malicious activity goes unnoticed, even if it initially evaded detection. The retroactive analysis performed by the CARTA engine 106 can improve over extremely long periods, enabling the CARTA engine 106 to pinpoint specific points in time where the multimodal anomalous activity began. The explainability of the multimodalities and their correlation is greatly improved by the analysis of the embeddings.

[0061] The CARTA engine 106 includes an integrated mini VLM used by Al Agents, a lightweight yet powerful localized model that operates within the security environment without the need for cloud-based processing. This model works alongside advanced multimodal data fusion techniques, combining and analyzing diverse data sources such as system logs, file access records, network traffic patterns, user behavior analytics, and biometric authentication data. This holistic approach allows the CARTA engine 106 to detect complex, multi-stage attack strategies that leverage subtle, seemingly unrelated anomalies across multiple data types.

[0062] The Al agents in the CARTA engine 106 employ multi-step reasoning to thoroughly analyze attack behaviors and assess their threat scope, storing their understanding for future reference. They generate an Adaptive Anomaly Scoring System based on the severity of the identified threats scope. The Al agents can be structured as adaptive, decision-making systems capable of processing vast amounts of data, reasoning through complex scenarios, and learning from interactions. The CARTA engine 106 can include intelligent algorithms that identify long dormant malware, slow-acting insider threats, and advanced persistent threats (APTs) that traditional signature-based detection systems often miss. By employing time-series modeling and sequence analysis, the CARTA engine 106 reconstructs the full timeline of cyber attack activities, revealing how malicious actors gained initial access, moved laterally within the system, and escalated privileges over time. The model handles long periods of time with different levels of resolution and obtains contextual information at those levels. This granular,Attorney Docket No.: 59103-0006W01

[0063] context-aware reconstruction enables security teams to understand the attack life cycle and address systemic vulnerabilities that may have been exploited.

[0064] In some implementations, the CARTA engine 106 continuously enhances its detection capabilities through adaptive learning. The CARTA engine 106 refines its threat recognition models using reinforcement learning, incorporating insights from newly discovered threats and updated global threat intelligence feeds. This dynamic learning process allows the CARTA engine 106 to reevaluate previously benign activities in light of emerging attack patterns, offering proactive defense against evolving threats.

[0065] By identifying these hidden risks and correlating disparate security events, the CARTA engine 106 can allow a system to close security gaps, harden its defenses, and implement targeted mitigation strategies against future incidents. This powerful retroactive analysis transforms cyber security from a reactive process into a continuous, evolving defense system capable of staying ahead of sophisticated cyber adversaries.

[0066] In some implementations, the CARTA engine 106 leverages advanced multimodal embedding analysis to unify and correlate diverse data types such as text logs, system events, fde access patterns, network activity, and user behavior analytics — into a cohesive threat detection model. This is achieved through custom alignment layers designed to project different data modalities into a shared embedding space, enabling the system to identify hidden relationships between seemingly unrelated security events. The integrated mini VLM employs generative Multimodal Large Language Models (M-LLMs) to enhance this fusion process, allowing for deeper contextual understanding of complex attack patterns. For example, by linking abnormal file access logs with unusual network connections and slight deviations in user login behavior, the CARTA engine 106 can uncover stealthy data exfiltration activities that bypass some conventional detection tools.

[0067] In some implementations, the CARTA engine 106 utilizes temporal correlation mapping to analyze historical data across multiple modalities and reconstruct the timeline of sophisticated cyber attacks. This involves linking past system events, user activities, and network traffic to identify how malicious actions unfolded over time. Through sequence analysis and time-series modeling, the system can detect the progression of multi-stage attacks, from initial compromise to lateral movement and data exfiltration. For example, the CARTA engine 106 can map how aAttorney Docket No.: 59103-0006W01

[0068] seemingly harmless script executed months ago was the starting point of a malware installation, later leading to privilege escalation and unauthorized data transfer.

[0069] In some implementations, the CARTA engine 106 integrates a dynamic anomaly scoring engine that continuously evaluates behavioral patterns and system activities to detect subtle indicators of compromise. Using adaptive scoring models, the system assigns context-aware risk scores to anomalies based on their correlation with historical attack patterns and current threat intelligence. This adaptive scoring of previous anomalies evolves in real-time through reinforcement learning, improving detection accuracy while reducing false positives. For example, a minor deviation in a user’s file access behavior may initially receive a low-risk score, but if combined with delayed network pings to external servers, the cumulative score increases, prompting proactive investigation.

[0070] In some implementations, the CARTA engine 106 employs synthetic data generation to simulate potential attack scenarios based on historical system vulnerabilities and threat trends. The agentic ability of the model to create and simulate attack vectors based on its history gives it autonomy and allows the hardening of the system. This simulated data enriches the model’s training process, allowing it to anticipate novel attack strategies and improve detection sensitivity. By introducing context- aware synthetic threats, the system can stress-test its detection algorithms against emerging malware and attack vectors, ensuring preparedness for real-world incidents. For example, if a new ransomware strain is detected in global threat feeds, the CARTA engine 106 generates simulated variations of the malware’s behavior and tests detection models against them, preemptively strengthening defenses.

[0071] In some implementations, the system automates the process of attack chain reconstruction, enabling security teams to trace back through layers of system activity and identify the root cause of breaches. This includes uncovering the initial access point, tracking lateral movement, and identifying compromised user accounts or devices. The CARTA engine 106 cross-references historical indicators of compromise (IOCS) with current system states, helping to attribute malicious actions to specific sources or threat actors. For example, after detecting data leakage, the CARTA engine 106 can reconstruct the attacker’s pathway, identifying the exploited vulnerability, compromised credentials, and exfiltration method used.

[0072] In some implementations, the CARTA engine 106 utilizes different forms of memory within an Al agentic system, e g., the system 100, by storing and recalling detailed records ofAttorney Docket No.: 59103-0006W01

[0073] past incidents, including attack patterns, system responses, and validation outcomes. This historical context allows Al agents to recognize recurring or similar threat behaviors, even when they are subtly modified. By tracking successful and failed mitigation approaches, the memory structure enables the system to refine its detection and response strategies, improving accuracy and resilience against evolving cyber threats.

[0074] The CARTA engine 106 can be implemented as a sophisticated cyber security component designed to perform in-depth analysis of historical system data to identify latent or evolving threats that may have bypassed initial detection mechanisms. By revisiting and scrutinizing extensive archives of system logs, file behaviors, user interactions, and network activities, the CARTA engine 106 uncovers hidden correlations and subtle patterns that could indicate longterm or stealthy cyber attacks. This retrospective analysis is enhanced by contextual awareness, allowing the system to interpret past data within the evolving threat landscape and detect anomalies that were previously considered benign but have since become relevant due to emerging attack vectors. In some implementations, the CARTA engine 106 continuously refines its understanding of system behaviors by integrating updates from new threat intelligence sources and adapting its analytical models to account for shifting tactics used by cyber criminals. This capability enables systems or organizations to identify dormant malware, insider threats, or slow-moving attacks that gradually infiltrate systems over time. By bringing these hidden threats to light, the CARTA engine 106 can enable security teams to conduct forensic investigations, patch vulnerabilities, and implement targeted security measures, potentially closing security gaps that could have otherwise led to significant breaches.

[0075] In some implementations, the CARTA engine 106 can perform multimodal embedding analysis. Multimodal embedding analysis can include processing historical logs, filing metadata, and behavioral data through custom embedding models. In some implementations, the CARTA engine 106 can perform temporal signal modeling. Temporal signal modeling can include mapping sequences of activities across multiple data modalities to detect coordinated attack patterns. In some implementations, the CARTA engine 106 can perform anomaly scoring by assigning threat scores based on correlations between past behaviors and known attack signatures. In some implementations, the CARTA engine 106 can represent or include a multiagent system. For example, The CARTA engine 106 can build a system of expert Al Agents that are responsible for specific tasks. The CARTA engine 106 can include an agent memory systemAttorney Docket No.: 59103-0006W01

[0076] that maintains task-specific data and contextual knowledge to support efficient decision-making for agents.

[0077] In some implementations, the CARTA engine 106 receives data from the Generative Al Virus Scanner 102 for in-depth retroactive analysis. If dormant malware or slow-acting threats are detected, an Adaptive Risk Mitigation Engine included in the system 100 is triggered to respond. For example, the Adaptive Risk Mitigation Engine can be the risk mitigation engine 310 illustrated in FIG. 3 below. Insights are fed back into the Federated Learning Module to strengthen global detection capabilities, e.g., of the system 100. As an example scenario, the CARTA engine 106 can identify that a file downloaded months prior exhibited a pattern similar to malware recently discovered in global threat feeds. In response, the CARTA engine 106 can trigger immediate quarantine and further analysis.

[0078] The Adaptive Malware Deception Network (AMDN) 108 is an advanced cyber security defense system that leverages Al-driven deception technology to proactively detect, isolate, and analyze sophisticated malware in real-time. Unlike sandboxing solutions that rely on static environments, AMDN 108 deploys dynamic, ALgenerated sandbox environments that evolve continuously to mimic legitimate system configurations, user behaviors, and network traffic. This adaptive and realistic simulation can deceive advanced malware, including polymorphic and fileless variants, into revealing their execution patterns and malicious intent.

[0079] In some implementations, the AMDN 108 utilizes a localized mini LLM Al Agent in conjunction with multimodal data fusion to construct and manage these deception environments. The Agent employs a mini VLM to intelligently analyze real-time system data, user activity, and network interactions to create sandboxes that are contextually aligned with the organization's infrastructure. These environments are indistinguishable from production systems, making them highly effective at luring sophisticated, evasive malware that typically avoids detection in some conventional sandbox setups. Unlike some traditional cyber honey pots which can be easily detected by sophisticated attackers and require manual monitoring and updates, the model has the ability to modify, classify, and enhance the current system state. Once malware is engaged within the deception network, AMDN 108 performs deep behavioral analysis to observe how the malicious code operates in an unrestricted, simulated environment. This analysis extends beyond traditional signature-based detection by monitoring system calls, memory manipulation, network communication, and file system interactions to uncover hidden attack vectors and novelAttorney Docket No.: 59103-0006W01

[0080] exploitation techniques. The system captures these behaviors in real-time, enabling security teams to extract Indicators of Compromise (IOCS) and reverse-engineer malware tactics without risking live systems.

[0081] In some implementations, the AMDN 108 can be further enhanced by its adaptive deception strategy, which continuously evolves based on ongoing threat intelligence and malware behavior. By leveraging reinforcement learning, the system can automatically modify sandbox configurations, adjust baiting techniques, and deploy new deception layers to outmaneuver attackers and detect malware that employs sandbox-evasion tactics. This dynamic adaptation increases a likelihood that even advanced threats, such as zero-day exploits and fileless malware, are effectively contained and analyzed.

[0082] In some implementations, the AMDN 108 integrates with broader cybersecurity frameworks to support automated threat response. Once a threat is identified and analyzed, AMDN 108 can automatically trigger mitigation protocols such as network isolation, automated malware signature generation, and patch deployment. This seamless integration accelerates the response time, reducing the attack window and limiting potential damage.

[0083] By combining realistic, Al-driven deception with advanced behavioral analysis and automated response, the AMDN 108 transforms malware detection and analysis into a proactive, autonomous defense strategy. This approach not only traps and neutralizes sophisticated malware but also provides actionable intelligence to fortify system defenses against future attacks.

[0084] The AMDN 108 employs Al-generated, highly dynamic sandbox environments designed to deceive and engage sophisticated malware. These sandboxes are not static; they are synthetically crafted user environments that mimic real-world system configurations, user behaviors, and network traffic. By leveraging multimodal data fusion and the localized mini VLM, the AMDN 108 creates convincing decoy systems populated with fake files, simulated user interactions, decoy credentials, and network activity that closely mirrors genuine workflows. These artificial environments are indistinguishable from actual production systems, compelling malware to activate its malicious payload without suspicion. For example, the AMDN 108 can simulate an employee's workstation with ongoing document editing, mock email communications, and dummy database queries, tricking malware designed to target specific user behaviors or enterprise systems into executing.Attorney Docket No.: 59103-0006W01

[0085] In some implementations, the dynamic sandbox generation can include creating deceptive environments tailored to suspected malware behavior (fake fdes, simulated user activity). The AMDN 108 can use behavioral triggers by modifying system conditions through Agents in realtime to expose malware that activates under specific triggers. The AMDN 108 can use real-time monitoring by analyzing malware behavior using self-supervised learning models to classify threats. The AMDN 108 can document agentic interaction. For example, the AMDN 108 can capture and record aspects of agent-driven interactions to reveal insights, underlying intentions, and actionable outcomes. The AMDN 108 can use a secure sandbox termination protocol. For example, the AMDN 108 deletes the sandbox promptly to improve security if the attack becomes uncontrollable.

[0086] Once malware is lured into these dynamic sandboxes, the AMDN 108 engages in realtime, deep behavioral analysis. Using self-supervised learning model, the system continuously monitors system calls, memory usage, file manipulations, network requests, and privilege escalation attempts. This allows the AMDN 108 to detect malicious actions based on behavior rather than static signatures, making it effective against polymorphic malware, fileless threats, and zero-day exploits. For example, if malware begins altering registry keys and initiating unauthorized remote connections, the AMDN 108 can immediately classify these actions as high-risk behaviors and initiate further analysis without exposing the actual network.

[0087] In some implementations, the AMDN 108 incorporates adaptive trigger mechanisms that dynamically adjust sandbox conditions to provoke malware that activates only under specific circumstances. Many advanced malware strains are designed to remain dormant or operate differently in virtualized or sandbox environments. To counter this, in some implementations, the AMDN 108 uses reinforcement learning to modify system attributes like OS versions, geolocation data, network latency, and hardware configurations in real-time. This adaptive approach forces condition-based malware to reveal its full range of malicious behaviors. For example, a piece of malware programmed to execute only on systems running a particular software version can sometimes be tricked into activation when the AMDN 108 simulates a conducive environment, exposing the payload of the malware for analysis.

[0088] In some implementations, the AMDN 108 can increase a likelihood that malware interactions remain within a secure, isolated containment layer, preventing any chance of the threat escaping into live systems. While safely contained, the AMDN 108 extracts behavioralAttorney Docket No.: 59103-0006W01

[0089] signatures, Indicators of Compromise (TOCs), and attack patterns. This intelligence is anonymized and securely shared with federated learning models across decentralized networks, enabling collective defense without compromising sensitive data. For example, if the AMDN 108 encounters a new ransomware strain, the AMDN 108 can generate a detailed behavioral profde and shares anonymized detection patterns with other AMDN 108 nodes, helping prevent similar attacks across partner organizations without exposing internal data.

[0090] In some implementations, the AMDN 108 can automate the process of malware dissection. The system uses the mini VLM to reverse-engineer the malware's execution flow, uncovering encryption routines, command-and-control communication channels, and persistence mechanisms. Based on this analysis, the AMDN 108 can autonomously trigger real-time mitigation responses, such as generating custom malware signatures, enforcing network segmentation, or deploying immediate patches across vulnerable systems. For example, if malware attempts to exploit a software vulnerability, the AMDN 108 not only blocks the threat but can automatically push security patches or configuration changes to prevent future exploitation.

[0091] In some implementations, the AMDN 108 continuously evolves its sandbox environments in response to emerging threats and malware behavior. By integrating live threat intelligence feeds and learning from various malware interaction, the system refines its deception strategies, ensuring it stays ahead of malware designed to detect and evade traditional sandboxes. This self-optimizing capability allows the AMDN 108 to counter even adaptive malware. The agentic nature of the AMDN 108 allows it to interact with system software, learn new threat vectors and update its knowledge. If threat intelligence reports reveal malware that checks for virtual machine artifacts before executing, the AMDN 108 will automatically eliminate those indicators within its sandbox, making the environment appear more authentic to attackers.

[0092] The AMDN 108 is an advanced cybersecurity framework designed to outmaneuver sophisticated malware through a dynamic and highly responsive local sandbox environment. This system intelligently crafts synthetic user environments that closely mimic real-world system behaviors, applications, and network interactions, creating a deceptive yet convincing setting that entices malware into activating its malicious payload. By continuously adapting these simulated conditions in response to detected threat signals, the AMDN 108 effectively lures advanced persistent threats (APTs), zero-day exploits, and polymorphic malware into revealing theirAttorney Docket No.: 59103-0006W01

[0093] tactics, techniques, and procedures (TTPs). Once isolated within this controlled environment, the malware’s behavior is meticulously monitored and analyzed in real time, allowing the system to identify its execution patterns, command-and-control communications, and exploitation methods. This deep behavioral analysis enables the rapid extraction of actionable threat intelligence, which can be used to develop targeted countermeasures and strengthen overall system defenses.

[0094] Additionally, because the AMDN 108 operates locally and autonomously, it can contain and neutralize threats without exposing sensitive data or relying on external cloud services, ensuring both high-speed response and data privacy. By actively deceiving and dissecting malware within a controlled space, the AMDN 108 not only prevents potential damage but also accelerates the development of proactive security strategies against evolving cyber threats.

[0095] Within the system 100, suspicious files flagged by the Generative Al Virus Scanner 102 can cause the generative Al virus scanner 102 to transmit a trigger 112 to the AMDN 108. For example, through the trigger 112, the suspicious files can be redirected to the AMDN 108 for deeper analysis. Behavioral data and findings from malware activity 118 can be shared with the PTAE 104 for predictive analysis, the CARTA engine 106 for historical information tracking, and the Federated Learning Module for model updates. Validated threats can trigger immediate mitigation via the Adaptive Risk Mitigation Engine included in the system 100. As an example scenario, a suspicious file can be placed in a synthetic directory with fake credentials. When the malware attempts to exfiltrate data, the AMDN 108 detects this behavior and neutralizes the threat.

[0096] In some implementations, the system 100 includes a Privacy -Preserving Federated Learning Module (not shown in figure). Such a model is designed to enable continuous system improvement while maintaining strict data privacy and security. Unlike some centralized learning models that require raw data to be transmitted to a central server for processing, this module facilitates decentralized learning by allowing individual devices to locally train machine learning models on sensitive data. Only encrypted model updates, rather than the data itself, are securely shared across devices, ensuring that personal or confidential information remains protected and compliant with data privacy regulations like General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). Leveraging secure aggregation techniques and trusted execution environments, the module prevents unauthorized access and safeguards against data leakage during model synchronization. This distributed learningAttorney Docket No.: 59103-0006W01

[0097] approach not only reduces the risk of data breaches but also enables the system to adapt to new and emerging threats in real time by learning from diverse data environments without compromising user privacy. As more devices contribute their locally trained insights, the global model evolves to become more robust and accurate, enhancing its ability to detect complex and novel cyber threats. This privacy-preserving mechanism increases a likelihood that security systems continuously improve while respecting data sovereignty and user trust, making it an important innovation in secure, scalable cybersecurity frameworks.

[0098] The Federated Learning Module uses locally stored data, allowing it to protect data during local model training. The Federated Learning Module uses encrypted model updates, in which model gradients and updates (not raw data) are transmitted using encryption. The Federated Learning Module uses global aggregation by combining updates from multiple devices to improve global threat detection models.

[0099] The Federated Learning Module can receive model updates from local Virus Scanners, insights from the PTAE 104, findings from the CARTA engine 106, and behavioral signatures from the AMDN 108. Aggregated models are distributed back to all devices, improving collective threat detection and response. As an example scenario, when malware is detected in one system’s AMDN, behavior patterns are anonymized and shared globally, enabling other systems to detect similar threats proactively.

[0100] FIG. 2 is a block diagram illustrating a data flow 200 by which data and updates are communicated throughout the system 100. According to the data flow 200, the generative Al virus scanner 102 communicates with each of the PTAE 104 and the CARTA engine 106. For example, the generative Al virus scanner 102 can provide system activity data to the PTAE 104 for predictive analysis. The generative Al virus scanner 102 can supply historical logs and behavior data to the CARTA engine 106 for retroactive scanning.

[0101] The PTAE 104 can receive the system activity data from the generative Al virus scanner 102. The PTAE 104 can also access one or more databases 202 that store information related to CVE, global security advisories, or both. The PTAE 104 can use information from the databases 202 to perform predictive analysis, as described above with reference to FIG. 1. The PTAE 104 can also transmit and receive secure updates 204 to and from the global model 206, e.g., via the Federated Learning Module.Attorney Docket No.: 59103-0006W01

[0102] The AMDN 108 can share behavioral data and findings from malware activity with the CARTA engine 106. The CARTA engine 106 can receive data from the Generative Al Virus Scanner 102 for in-depth retroactive analysis. The CARTA engine 106 can also transmit and receive secure updates 204 to and from the global model 206, e.g., via the Federated Learning Module.

[0103] The global model 206 is a model used by one or more components of the system 100 to process data indicating potential threats to generate outputs related to predictive analyses of the potential threats. The global model 206 can be a model that is used by multiple threat detection systems similar to the system 100. For example, each threat detection system can include a Federated Learning Module that facilitates communications between local machine learning models included in each of the threat detection systems and the global model 206. Through the respective Federated Learning Module of each threat detection system, each threat detection system can receive secure updates to the locally trained machine learning models, allowing for learnings across all systems to be shared in a way that facilitates data privacy, as described above with reference to FIG. 1. For example, as illustrated in FIG. 2, the global model 206 can, via the Federated Learning Module of the system 100, send and receive secure updates 204 to and from the PTAE 104, the CARTA engine 106, or both.

[0104] FIG. 3 is a block diagram illustrating an operational workflow 300 for threat detection and adaptive mitigation. The threat detection system 100 of FIG. 1 can use the workflow 300.

[0105] In the workflow 300, the generative Al virus generative Al virus scanner 102 continuously monitors system activity. By continuously monitoring the system activity, the generative Al virus scanner 102 is able to detect an anomaly 302 in real-time. For example, the anomaly 302 can be an event that indicates a threat to the security of the system.

[0106] The PTAE 104 can perform predictive analysis. For example, the generative Al virus generative Al virus scanner 102 can communicate system data, e.g., the system data 114 of FIG.

[0107] 1, to the PTAE 104. The system data can include an indication of the anomaly 302. The PTAE 104 can analyze the system data to forecast potential threats and initiates preemptive defenses. In response, the PTAE 104 can generate a dynamic risk score 308 for the anomaly 302.

[0108] The CARTA engine 106 can scan historical data 304 for dormant or missed threats. In response, the CARTA engine 106 can generate an anomaly score 306. As described above with reference to FIG. 1, the anomaly score 306 can be a context-aware risk score assigned by theAttorney Docket No.: 59103-0006W01

[0109] CARTA engine 106 to the anomaly 302 based on its correlation with historical attack patterns and current threat intelligence.

[0110] The anomaly score 306, the dynamic risk score 308, or both, can be processed by a risk mitigation engine 310 included in the system. In response to processing the anomaly score 306, the dynamic risk score 108, or both, the risk mitigation engine 310 can determine to isolate one or more suspicious files in the AMDN 108 for dynamic analysis. The risk mitigation engine 310, the AMDN 108, or both, can determine to deploy one or more patches 312, e.g., in response to the threat indicated by the anomaly 302. The risk mitigation engine 310, the AMDN 108, or both, can determine to adjust one or more firewall rules 314, e.g., in response to the threat indicated by the anomaly 302.

[0111] In some implementations, in the workflow 300, secure model updates are aggregated through the Federated Learning Module, e.g., included in the system 100, to improve detection across all systems.

[0112] FIG. 4 is a block diagram 400 illustrating communications orchestrated by the Federated Learning Module of the system 100 between the global model 206 and the system 100.

[0113] As illustrated in the diagram 400, the PTAE 104 can monitor system behavior in real time to detect live data 402 that can include early indicators of potential vulnerabilities that might otherwise go unnoticed. The CARTA engine 106 can access system historical data 404 to mine past activity for signs of potential threats.

[0114] As the system 100 performs operations to detect potential threats and mitigate security risk, e.g., operations described above with reference to FIG. 1, the system 100 can communicate with the global model 206, e.g., via the Federated Learning Module. For example, each of the generative Al virus scanner 102, the PTAE 104, and the CARTA engine 106 can transmit and receive secure updates 204 to and from the global model 206.

[0115] FIG. 5 is a flow diagram of an example process 500 for initiating actions to mitigate a cybersecurity threat. For convenience, the process 500 will be described as being performed by a system of one or more computing devices and programmed appropriately in accordance with this specification. For example, a threat detection system, e.g., the threat detection system 100 of FIG. 1, appropriately programmed, can perform the process 500.

[0116] The system receives, at one or more computing devices, multimodal data related to user activities, network traffic, and system operations associated with a computer system (502).Attorney Docket No.: 59103-0006W01

[0117] In some implementations, the multimodal data includes one or more of telemetry data associated with the computer system, behavioral analytics, biometric data, fde metadata, and global threat intelligence.

[0118] In some implementations, the one or more computing devices and the computer system are connected over a local area network. In some implementations, the one or more computing devices are part of the computer system. In some implementations, the one or more computing devices and the computer system are part of a same trusted execution environment (TEE).

[0119] The system analyzes, by at least one agentic vision language model (VLM) executing on the one or more computing devices, the multimodal data, to determine that at least a portion of the multi-modal data represents cybersecurity threat to the computer system (504). The agentic VLM is trained to predict cybersecurity threats based on analyzing temporal patterns in the multimodal data across multiple time periods.

[0120] In some implementations, the at least one agentic VLM is trained to generate multiple embeddings based on the multimodal data, wherein the cybersecurity threat is detected based on the multiple embeddings. In some implementations, the at least one agentic VLM is configured to preemptively identify the cybersecurity threat prior to the cybersecurity threat causing a compromise to the computer system. The agentic VLM can be trained using federated learning.

[0121] In some implementations, the portion of the computer system simulates an environment configured to be affected by the cybersecurity threat. In some implementations, the one or more computing devices are configured to track the cybersecurity threat within the environment. In some implementations, the training of the at least one agentic VLM is updated based on tracking the cybersecurity threat within the environment.

[0122] In some implementations, the environment is simulated in response to identifying that a trigger condition associated with activating the cybersecurity threat is satisfied.

[0123] Responsive to determining that at least a portion of the multi-modal data represents a cybersecurity threat, the system initiates one or more actions configured to mitigate the cybersecurity threat (506).

[0124] In some implementations, the one or more actions include isolating the cybersecurity threat into a portion of the computer system. In some implementations, the one or more actions include dynamically adjusting security controls. Dynamically adjusting the security controls canAttorney Docket No.: 59103-0006W01

[0125] include at least one of: deploying software patches, modifying firewall rules, quarantining compromised devices, or isolating suspicious network segments.

[0126] FIG. 6 shows an example of a computing device 600 and example of a display devices 680 / 682 that can be used to implement the techniques described here. For example, the computing device 600 can be or include the threat detection system 100 of FIG. 1, and the display device 680 / 682 can be a display device in communication with the threat detection system. The computing device 600 is intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The display device is intended to represent various forms of mobile devices, such as personal digital assistants, cellular telephones, smartphones, and other similar computing devices. The components shown here, their connections and relationships, and their functions, are meant to be exemplary only, and are not meant to limit implementations described and / or claimed in this document.

[0127] The computing device 600 includes a processor 602, a memory 604, a storage device 606, a high-speed interface 608 connecting to the memory 604 and multiple high-speed expansion ports 610, and a low-speed interface 612 connecting to a low-speed expansion port 614 and the storage device 606. Each of the processor 602, the memory 604, the storage device 606, the high-speed interface 608, the high-speed expansion ports 610, and the low-speed interface 612, are interconnected using various buses, and can be mounted on a common motherboard or in other manners as appropriate. The processor 602 can process instructions for execution within the computing device 600, including instructions stored in the memory 604 or on the storage device 606 to display graphical information for a GUI on an external input / output device, such as a display 616 coupled to the high-speed interface 608. In other implementations, multiple processors and / or multiple buses can be used, as appropriate, along with multiple memories and types of memory. Also, multiple computing devices can be connected, with each device providing portions of the operations (e.g., as a server bank, a group of blade servers, or a multi-processor system).

[0128] The memory 604 stores information within the computing device 600. In some implementations, the memory 604 is a volatile memory unit or units. In some implementations, the memory 604 is a non-volatile memory unit or units. The memory 604 can also be another form of computer-readable medium, such as a magnetic or optical disk.Attorney Docket No.: 59103-0006W01

[0129] The storage device 606 is capable of providing mass storage for the computing device 600. In some implementations, the storage device 606 can be or contain a computer-readable medium, such as a floppy disk device, a hard disk device, an optical disk device, or a tape device, a flash memory or other similar solid state memory device, or an array of devices, including devices in a storage area network or other configurations. A computer program product can be tangibly embodied in an information carrier. The computer program product can also contain instructions that, when executed, perform one or more methods, such as those described above. The computer program product can also be tangibly embodied in a computer-or machine-readable medium, such as the memory 604, the storage device 606, or memory on the processor 602.

[0130] The high-speed interface 608 manages bandwidth-intensive operations for the computing device 600, while the low-speed interface 612 manages lower bandwidth-intensive operations. Such allocation of functions is exemplary only. In some implementations, the high-speed interface 608 is coupled to the memory 604, the display 616 (e.g., through a graphics processor or accelerator), and to the high-speed expansion ports 610, which can accept various expansion cards (not shown). In the implementation, the low-speed interface 612 is coupled to the storage device 606 and the low-speed expansion port 614. The low-speed expansion port 614, which can include various communication ports (e.g., USB, Bluetooth, Ethernet, wireless Ethernet) can be coupled to one or more input / output devices, such as a keyboard, a pointing device, a scanner, or a networking device such as a switch or router, e g., through a network adapter.

[0131] The computing device 600 can be implemented in a number of different forms, as shown in the figure. For example, it can be implemented as a server 620, or multiple times in a group of such servers. In addition, it can be implemented in a personal computer such as a laptop computer 622. It can also be implemented as part of a rack server system 524. Alternatively, components from the computing device 600 can be combined with other components in a mobile device (not shown), such as a display device 650. Each of such devices can contain one or more of the computing device 600 and the display device 650, and an entire system can be made up of multiple computing devices communicating with each other.

[0132] The display device 650 includes a processor 652, a memory 664, an input / output device such as a display 654, a communication interface 666, and a transceiver 668, among other components. The display device 650 can also be provided with a storage device, such as aAttorney Docket No.: 59103-0006W01

[0133] micro-drive or other device, to provide additional storage. Each of the processor 652, the memory 664, the display 654, the communication interface 666, and the transceiver 668, are interconnected using various buses, and several of the components can be mounted on a common motherboard or in other manners as appropriate.

[0134] The processor 652 can execute instructions within the display device 650, including instructions stored in the memory 664. The processor 652 can be implemented as a chipset of chips that include separate and multiple analog and digital processors. The processor 652 can provide, for example, for coordination of the other components of the display device 650, such as control of user interfaces, applications run by the display device 650, and wireless communication by the display device 650.

[0135] The processor 652 can communicate with a user through a control interface 658 and a display interface 656 coupled to the display 654. The display 654 can be, for example, a TFT (Thin-Film-Transistor Liquid Crystal Display) display or an OLED (Organic Light Emitting Diode) display, or other appropriate display technology. The display interface 656 can comprise appropriate circuitry for driving the display 654 to present graphical and other information to a user. The control interface 658 can receive commands from a user and convert them for submission to the processor 652. In addition, an external interface 662 can provide communication with the processor 652, so as to enable near area communication of the display device 650 with other devices. The external interface 662 can provide, for example, for wired communication in some implementations, or for wireless communication in other implementations, and multiple interfaces can also be used.

[0136] The memory 664 stores information within the display device 650. The memory 664 can be implemented as one or more of a computer-readable medium or media, a volatile memory unit or units, or a non-volatile memory unit or units. An expansion memory 674 can also be provided and connected to the display device 650 through an expansion interface 672, which can include, for example, a SIMM (Single In Line Memory Module) card interface. The expansion memory 674 can provide extra storage space for the display device 650, or can also store applications or other information for the display device 650. Specifically, the expansion memory 674 can include instructions to carry out or supplement the processes described above, and can include secure information also. Thus, for example, the expansion memory 674 can be provide as a security module for the display device 650, and can be programmed with instructions that permitAttorney Docket No.: 59103-0006W01

[0137] secure use of the display device 650. In addition, secure applications can be provided via the SIMM cards, along with additional information, such as placing identifying information on the SIMM card in a non-hackable manner.

[0138] The memory can include, for example, flash memory and / or NVRAM memory (nonvolatile random access memory), as discussed below. In some implementations, a computer program product is tangibly embodied in an information carrier. The computer program product contains instructions that, when executed, perform one or more methods, such as those described above. The computer program product can be a computer- or machine-readable medium, such as the memory 664, the expansion memory 674, or memory on the processor 652. In some implementations, the computer program product can be received in a propagated signal, for example, over the transceiver 668 or the external interface 662.

[0139] The display device 650 can communicate wirelessly through the communication interface 666, which can include digital signal processing circuitry. The communication interface 666 can provide for communications under various modes or protocols, such as GSM voice calls (Global System for Mobile communications), SMS (Short Message Service), EMS (Enhanced Messaging Service), or MMS messaging (Multimedia Messaging Service), CDMA (code division multiple access), TDMA (time division multiple access), PDC (Personal Digital Cellular), WCDMA (Wideband Code Division Multiple Access), CDMA2000, or GPRS (General Packet Radio Service), among others. Such communication can occur, for example, through the transceiver 668 using a radio-frequency. In addition, short-range communication can occur, such as using a Bluetooth, WiFi, or other such transceiver (not shown). In addition, a GPS (Global Positioning System) receiver module 670 can provide additional navigation- and location-related wireless data to the display device 650, which can be used as appropriate by applications running on the display device 650.

[0140] The display device 650 can also communicate audibly using an audio codec 660, which can receive spoken information from a user and convert it to usable digital information. The audio codec 660 can likewise generate audible sound for a user, such as through a speaker, e.g., in a handset of the display device 650. Such sound can include sound from voice telephone calls, can include recorded sound (e.g., voice messages, music files, etc.) and can also include sound generated by applications operating on the display device 650.Attorney Docket No.: 59103-0006W01

[0141] The display device 650 can be implemented in a number of different forms, as shown in the figure. For example, it can be implemented as a cellular telephone 680. It can also be implemented as part of a smart-phone 682, personal digital assistant, or other similar mobile device.

[0142] In this specification the term “engine” is used broadly to refer to a software-based system, subsystem, or process that is programmed to perform one or more specific functions. Generally, an engine will be implemented as one or more software modules or components, installed on one or more computers in one or more locations. In some cases, one or more computers will be dedicated to a particular engine; in other cases, multiple engines can be installed and running on the same computer or computers.

[0143] The subject matter and the actions and operations described in this specification can be implemented in digital electronic circuitry, in tangibly-embodied computer software or firmware, in computer hardware, including the structures disclosed in this specification and their structural equivalents, or in combinations of one or more of them. The subject matter and the actions and operations described in this specification can be implemented as or in one or more computer programs, e.g., one or more modules of computer program instructions, encoded on a computer program carrier, for execution by, or to control the operation of, data processing apparatus. The carrier can be a tangible non-transitory computer storage medium. Alternatively or in addition, the carrier can be an artificially-generated propagated signal, e.g., a machine-generated electrical, optical, or electromagnetic signal, that is generated to encode information for transmission to suitable receiver apparatus for execution by a data processing apparatus. The computer storage medium can be or be part of a machine-readable storage device, a machine-readable storage substrate, a random or serial access memory device, or a combination of one or more of them. A computer storage medium is not a propagated signal.

[0144] The term “data processing apparatus” encompasses all kinds of apparatus, devices, and machines for processing data, including by way of example a programmable processor, a computer, or multiple processors or computers. Data processing apparatus can include specialpurpose logic circuitry, e.g., an FPGA (field programmable gate array), an ASIC

[0145] (application-specific integrated circuit) , or a GPU (graphics processing unit). The apparatus can also include, in addition to hardware, code that creates an execution environment for computerAttorney Docket No.: 59103-0006W01

[0146] programs, e.g., code that constitutes processor firmware, a protocol stack, a database management system, an operating system, or a combination of one or more of them.

[0147] A computer program can be written in any form of programming language, including compiled or interpreted languages, or declarative or procedural languages; and it can be deployed in any form, including as a stand-alone program, e.g., as an app, or as a module, component, engine, subroutine, or other unit suitable for executing in a computing environment, which environment may include one or more computers interconnected by a data communication network in one or more locations.

[0148] A computer program may, but need not, correspond to a file in a file system. A computer program can be stored in a portion of a file that holds other programs or data, e.g., one or more scripts stored in a markup language document, in a single file dedicated to the program in question, or in multiple coordinated files, e g., files that store one or more modules,

[0149] sub-programs, or portions of code.

[0150] The processes and logic flows described in this specification can be performed by one or more computers executing one or more computer programs to perform operations by operating on input data and generating output. The processes and logic flows can also be performed by special-purpose logic circuitry, e.g., an FPGA, an ASIC, or a GPU, or by a combination of special-purpose logic circuitry and one or more programmed computers.

[0151] Computers suitable for the execution of a computer program can be based on general or special-purpose microprocessors or both, or any other kind of central processing unit. Generally, a central processing unit will receive instructions and data from a read-only memory or a random access memory or both. Elements of a computer include a central processing unit for executing instructions and one or more memory devices for storing instructions and data. The central processing unit and the memory can be supplemented by, or incorporated in, special-purpose logic circuitry.

[0152] Generally, a computer will also include, or be operatively coupled to, one or more mass storage devices, and be configured to receive data from or transfer data to the mass storage devices. The mass storage devices can be, for example, magnetic, magneto-optical, or optical disks, or solid state drives. However, a computer need not have such devices. Moreover, a computer can be embedded in another device, e.g., a mobile telephone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a Global Positioning SystemAttorney Docket No.: 59103-0006W01

[0153] (GPS) receiver, or a portable storage device, e.g., a universal serial bus (USB) flash drive, to name just a few.

[0154] To provide for interaction with a user, the subject matter described in this specification can be implemented on one or more computers having, or configured to communicate with, a display device, e.g., a LCD (liquid crystal display) monitor, or a virtual-reality (VR) or augmented-reality (AR) display, for displaying information to the user, and an input device by which the user can provide input to the computer, e.g., a keyboard and a pointing device, e.g., a mouse, a trackball or touchpad. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback and responses provided to the user can be any form of sensory feedback, e.g., visual, auditory, speech, or tactile feedback or responses; and input from the user can be received in any form, including acoustic, speech, tactile, or eye tracking input, including touch motion or gestures, or kinetic motion or gestures or orientation motion or gestures. In addition, a computer can interact with a user by sending documents to and receiving documents from a device that is used by the user; for example, by sending web pages to a web browser on a user’s device in response to requests received from the web browser, or by interacting with an app running on a user device, e.g., a smartphone or electronic tablet. Also, a computer can interact with a user by sending text messages or other forms of message to a personal device, e.g., a smartphone that is running a messaging application, and receiving responsive messages from the user in return.

[0155] This specification uses the term “configured to” in connection with systems, apparatus, and computer program components. That a system of one or more computers is configured to perform particular operations or actions means that the system has installed on it software, firmware, hardware, or a combination of them that in operation cause the system to perform the operations or actions. That one or more computer programs is configured to perform particular operations or actions means that the one or more programs include instructions that, when executed by data processing apparatus, cause the apparatus to perform the operations or actions. That special-purpose logic circuitry is configured to perform particular operations or actions means that the circuitry has electronic logic that performs the operations or actions.

[0156] In addition to the embodiments of the attached claims and the embodiments described above, the following numbered embodiments are also innovative.Attorney Docket No.: 59103-0006W01

[0157] Embodiment l is a method, the method comprising: receiving, at one or more computing devices, multimodal data related to user activities, network traffic, and system operations associated with a computer system; analyzing, by at least one agentic vision language model (VLM) executing on the one or more computing devices, the multimodal data, to determine that at least a portion of the multi-modal data represents a cybersecurity threat to the computer system, wherein the agentic VLM is trained to predict cybersecurity threats based on analyzing temporal patterns in the multimodal data across multiple time periods; and responsive to determining that at least a portion of the multi-modal data represents a cybersecurity threat, initiating one or more actions configured to mitigate the cybersecurity threat.

[0158] Embodiment 2 is the method of embodiment 1 wherein the multimodal data comprises one or more of telemetry data associated with the computer system, behavioral analytics, biometric data, file metadata, and global threat intelligence.

[0159] Embodiment 3 is the method of any of embodiments 1 or 2, wherein the one or more computing devices and the computer system are connected over a local area network.

[0160] Embodiment 4 is the method of any of embodiments 1 or 2, wherein the one or more computing devices are part of the computer system.

[0161] Embodiment 5 is the method of any of embodiments 1 or 2, wherein the one or more computing devices and the computer system are part of a same trusted execution environment (TEE).

[0162] Embodiment 6 is the method of any of embodiments 1-5, wherein the at least one agentic VLM is trained to generate multiple embeddings based on the multimodal data, wherein the cybersecurity threat is detected based on the multiple embeddings.

[0163] Embodiment 7 is the method of any of embodiments 1-6, wherein the at least one agentic VLM is configured to preemptively identify the cybersecurity threat prior to the cybersecurity threat causing a compromise to the computer system.

[0164] Embodiment 8 is the method of any of embodiments 1-7, wherein the one or more actions comprise isolating the cybersecurity threat into a portion of the computer system.

[0165] Embodiment 9 is the method of embodiment 8, wherein the portion of the computer system simulates an environment configured to be affected by the cybersecurity threat.

[0166] Embodiment 10 is the method of embodiment 9, wherein the one or more computing devices are configured to track the cybersecurity threat within the environment.Attorney Docket No.: 59103-0006W01

[0167] Embodiment 11 is the method of embodiment 10, wherein the training of the at least one agentic VLM is updated based on tracking the cybersecurity threat within the environment.

[0168] Embodiment 12 is the method of embodiment 9, wherein the environment is simulated in response to identifying that a trigger condition associated with activating the cybersecurity threat is satisfied.

[0169] Embodiment 13 is the method of any of embodiments 1-12, wherein the agentic VLM is trained using federated learning.

[0170] Embodiment 14 is the method of any of embodiments 1-13, wherein the one or more actions comprise dynamically adjusting security controls.

[0171] Embodiment 15 is the method of embodiment 14, wherein dynamically adjusting the security controls comprises at least one of: deploying software patches, modifying firewall rules, quarantining compromised devices, or isolating suspicious network segments.

[0172] Embodiment 16 is a system comprising: one or more computers and one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform the method of any one of embodiments 1 to 15.

[0173] Embodiment 17 is one or more non-transitory computer storage media encoded with computer program instructions that when executed by one or more computers cause the one or more computers to perform operations comprising the method of any one of embodiments 1 to 15.

[0174] While this specification contains many specific implementation details, these should not be construed as limitations on the scope of what is being claimed, which is defined by the claims themselves, but rather as descriptions of features that may be specific to particular embodiments. Certain features that are described in this specification in the context of separate embodiments can also be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment can also be implemented in multiple embodiments separately or in any suitable subcombination. Moreover, although features may be described above as acting in certain combinations and even initially be claimed as such, one or more features from a claimed combination can in some cases be excised from the combination, and the claim may be directed to a subcombination or variation of a subcombination.

[0175] Similarly, while operations are depicted in the drawings and recited in the claims in a particular order, this by itself should not be understood as requiring that such operations beAttorney Docket No.: 59103-0006W01

[0176] performed in the particular order shown or in sequential order, or that all illustrated operations be performed, to achieve desirable results. In certain circumstances, multitasking and parallel processing may be advantageous. Moreover, the separation of various system modules and components in the embodiments described above should not be understood as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.

[0177] Particular embodiments of the subject matter have been described. Other embodiments are within the scope of the following claims. For example, the actions recited in the claims can be performed in a different order and still achieve desirable results. As one example, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some cases, multitasking and parallel processing may be advantageous

[0178] What is claimed is:

Claims

Attorney Docket No.: 59103-0006W01CLAIMS1. A computer-implemented method for predictive cybersecurity threat detection, the method comprising:receiving, at one or more computing devices, multimodal data related to user activities, 5 network traffic, and system operations associated with a computer system;analyzing, by at least one agentic vision language model (VLM) executing on the one or more computing devices, the multimodal data, to determine that at least a portion of the multimodal data represents a cybersecurity threat to the computer system, wherein the agentic VLM is trained to predict cybersecurity threats based on analyzing temporal patterns in the multimodal 10 data across multiple time periods; andresponsive to determining that at least a portion of the multi-modal data represents a cybersecurity threat, initiating one or more actions configured to mitigate the cybersecurity threat.

152. The method of claim 1, wherein the multimodal data comprises one or more of telemetry data associated with the computer system, behavioral analytics, biometric data, file metadata, and global threat intelligence.

3. The method of any one of claims 1-2, wherein the one or more computing devices and the 20 computer system are connected over a local area network.

4. The method of any one of claims 1-2, wherein the one or more computing devices are part of the computer system.

255. The method of any one of claims 1-2, wherein the one or more computing devices and the computer system are part of a same trusted execution environment (TEE).

6. The method of any one of claims 1-5, wherein the at least one agentic VLM is trained to generate multiple embeddings based on the multimodal data, wherein the cybersecurity threat is detected 30 based on the multiple embeddings.Attorney Docket No.: 59103-0006W017. The method of any one of claims 1 -6, wherein the at least one agentic VLM is configured to preemptively identify the cybersecurity threat prior to the cybersecurity threat causing a compromise to the computer system.

58. The method of any one of claims 1-7, wherein the one or more actions comprise isolating the cybersecurity threat into a portion of the computer system.

9. The method of claim 8, wherein the portion of the computer system simulates an environment configured to be affected by the cybersecurity threat.1010. The method of claim 9, wherein the one or more computing devices are configured to track the cybersecurity threat within the environment.

11. The method of claim 10, wherein the training of the at least one agentic VLM is updated based 15 on tracking the cybersecurity threat within the environment.

12. The method of claim 9, wherein the environment is simulated in response to identifying that a trigger condition associated with activating the cybersecurity threat is satisfied.2013. The method of any one of claims 1-12, wherein the agentic VLM is trained using federated learning.

14. The method of any of claims 1-13, wherein the one or more actions comprise dynamically adjusting security controls.2515. The method of claim 14, wherein dynamically adjusting the security controls comprises at least one of: deploying software patches, modifying firewall rules, quarantining compromised devices, or isolating suspicious network segments.30 16. A system comprising:one or more computers and one or more storage devices on which are stored instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising any of the methods of claims 1-15.Attorney Docket No.: 59103-0006W0117. One or more non-transitory computer storage media encoded with computer program instructions that when executed by one or more computers cause the one or more computers to perform operations comprising any of the methods of claims 1-15.

Images