Agent Message Bus With Local Aggregation for Security Event Routing

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Cybersecurity threats evade modern security tools by delivering or executing malicious code within computing environments, necessitating sophisticated and frequent messaging capabilities to monitor and report security breaches.

Innovation Solution

An agent-based messaging bus that selectively transmits messages indicative of system health, including malicious activity, to a cloud-connected monitoring platform, utilizing a router with a routing policy and an aggregation, correlation, and detection core (AC+DC) to process and route messages efficiently, reducing resource consumption and enhancing flexibility.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If all messages are transmitted to the monitoring platform, then complete security monitoring is achieved, but bandwidth consumption and processing costs increase

Engineering Contradiction:

Improvesecurity monitoring completenessVSAvoidbandwidth consumption

Core Design Contradiction:

ReliabilityVSLoss of energy

Solution Approach 1:

The patent applies local quality by implementing different message handling strategies at different locations in the system. The AC+DC component processes and aggregates similar messages locally before transmission, while the monitoring platform focuses on analyzing aggregated results. This distributed differentiation reduces overall bandwidth consumption while maintaining monitoring effectiveness.

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The patent merges multiple similar messages into aggregated messages through the AC+DC component. Instead of transmitting every individual message to the monitoring platform, similar messages are combined and consolidated, reducing the total volume of data transmitted while preserving the essential security information.

Inventive Principle:

Principle #5Merging (Combining)

2Reliability

If message processing is performed at the monitoring platform, then centralized analysis is achieved, but processing time and costs increase

Engineering Contradiction:

Improvecentralized security analysisVSAvoidmessage processing time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent implements preliminary action by performing message aggregation and correlation at the AC+DC component before messages reach the monitoring platform. This pre-processing reduces the workload at the monitoring platform, enabling faster analysis and response times while maintaining centralized security analysis capabilities.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent segments the message processing function into two parts: the AC+DC component handles aggregation and correlation of messages, while the monitoring platform focuses on analysis and response. This segmentation distributes processing tasks, reducing the time burden on the monitoring platform while maintaining centralized analysis.

Inventive Principle:

Principle #1Segmentation

3Measurement precision

If sophisticated messaging capabilities are implemented to detect all security threats, then detection accuracy is improved, but system complexity increases

Engineering Contradiction:

Improvesecurity threat detection accuracyVSAvoidmessaging system complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The patent introduces the AC+DC component as an intermediary between message sources and the monitoring platform. This intermediary performs aggregation and correlation functions, simplifying the overall system architecture while maintaining sophisticated detection capabilities through structured message processing and analysis.

Inventive Principle:

Principle #24Intermediary (Mediator)

4Loss of information

If all messages are stored and processed, then complete security audit trail is maintained, but storage costs and processing overhead increase

Engineering Contradiction:

Improvesecurity event information completenessVSAvoiddata storage volume

Core Design Contradiction:

Loss of informationVSQuantity of substance

Solution Approach 1:

The patent combines and aggregates similar messages at the AC+DC component, reducing the total volume of data that needs to be stored and processed at the monitoring platform. This consolidation maintains the essential security audit trail information while significantly reducing storage requirements.

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The patent selectively discards redundant or duplicate messages through the AC+DC aggregation process, while recovering and preserving the essential security information in aggregated form. This approach reduces storage volume while maintaining the integrity of the security audit trail.

Inventive Principle:

Principle #34Discarding and recovering

Data Source

PatentUS20260073048A1Agent Message Bus

Publication Date: 2026.03.12 HALCYON TECH

AI summary

Applications and processes executing on an endpoint are monitored to identify behavior indicative of malicious activity such as a ransomware attack. Messages generated from this monitoring as well as messages derived from external sources are stored in a queue for routing. A router selects some messages from the queue based on a routing policy and sends them to a cloud-based platform that can initiate various actions based on received messages. The router also sends some messages from the queue to a module that analyzes the messages and reduces their size by aggregating, correlating, and detecting relevant information. The module puts the modified messages back into the queue for further routing by the router according to the policy. Related apparatus, systems, techniques and articles are also described.