Baseline-Based Cloud Threat Detection With Noise Thresholding

The patent introduces sensors as intermediary components that collect runtime data and pass it to a backend analysis system. The sensors themselves consume minimal resources, while the heavy lifting of threat detection is performed by the backend server that has access to established baselines. This mediator approach allows comprehensive detection without burdening the endpoint resources.

The patent extracts the computationally intensive threat detection logic from the endpoint agents and relocates it to a centralized backend system. The agents/sensors only retain the lightweight function of data collection and transmission, while the complex analysis using established baselines is performed remotely, reducing endpoint resource consumption.

The backend server acts as an intermediary that manages the complexity of threat detection logic, rule updates, and baseline establishment. Sensors on endpoints simply collect and report data, while the backend handles the complex tasks of analysis and response coordination, simplifying the endpoint deployment.

The centralized backend system provides universal threat detection capabilities that serve multiple endpoints simultaneously. It handles baseline management, threat analysis, and response coordination for all connected sensors, reducing the need for each endpoint to have full detection capabilities and thereby reducing overall system complexity.

The patent merges the advantages of both agentless and agent-based approaches by deploying lightweight sensors that collect runtime data (enabling real-time detection) while using a centralized backend for analysis (maintaining low resource consumption). This combination achieves real-time threat detection without the heavy resource usage of traditional agents.

The backend server serves as an intermediary that receives runtime data from sensors and performs comprehensive threat analysis using established baselines. This allows real-time detection capabilities to be achieved without requiring heavy local processing at each endpoint, thus maintaining low resource consumption while enabling real-time response.

The system changes the parameter of data processing by using established baselines to contextualize runtime events. Instead of treating all events equally, the system compares events against known normal behavior patterns, transforming raw event data into meaningful threat indicators. This parameter change enables accurate detection while filtering out noise that deviates from established baselines.

The system implements feedback mechanisms where detection results and noise patterns are continuously analyzed to refine baseline establishment. By feeding back detection outcomes into the baseline update process, the system learns to distinguish between legitimate runtime variations and actual threats, improving detection accuracy while reducing false positives over time.