Endpoint Agent Translation for Real-Time Threat Containment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems lack real-time threat detection and autonomous response capabilities, especially when deploying new endpoint host agents is not feasible, and there is a need for a universal communication method to utilize existing third-party logging and endpoint tools on computing devices.
Innovation Solution
An endpoint agent with modules for communication and data collection, coupled with a cyber security appliance using machine-learning models, autonomously detects and responds to cyber threats by analyzing pattern of life data, and can adapt to existing third-party endpoint agents through a unifying translator.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a new endpoint host agent is deployed to extend threat detection and response capabilities, then real-time threat detection and autonomous response are improved, but device complexity and ease of operation deteriorate due to installation and configuration requirements
Solution Approach 1:
The patent uses an intermediary approach by leveraging existing third-party logging tools and endpoint agents as mediators. Instead of requiring deployment of new host agents, the system communicates with already-installed security tools through standardized APIs to collect pattern of life data, thereby extending threat detection capabilities without adding deployment complexity
Solution Approach 2:
The system implements universality by creating a communication framework that can work with multiple types of existing endpoint tools and logging solutions through a unified API interface. This allows the threat detection system to function across diverse endpoint environments without requiring tool-specific implementations or additional agent deployments
2Measurement precision
If comprehensive pattern of life data is collected from multiple software processes and users, then measurement precision and threat detection accuracy are improved, but loss of time and energy increase due to data collection overhead
Solution Approach 1:
The system applies preliminary action by collecting and storing pattern of life data continuously in the background before threats occur. Existing endpoint agents and logging tools accumulate baseline behavioral data about software processes and user activities, so when a threat is detected, the analysis can immediately compare against pre-established patterns without requiring real-time data gathering
Solution Approach 2:
The patent implements continuity of useful action through continuous background data collection by existing endpoint agents. The pattern of life data gathering operates continuously as part of normal endpoint monitoring functions, ensuring that comprehensive behavioral baselines are always available for immediate threat comparison without interrupting system operations or consuming additional real-time resources
Data Source
AI summary
The endpoint agent detects a cyber threat on an end-point computing device. The endpoint agent on the computing device has a communications module that communicates with a cyber defense appliance. A collections module monitors and collects pattern of life data on processes executing on the end-point computing-device and users of the end-point computing-device. The communications module sends the pattern of life data to the cyber defense appliance installed on a network. The cyber defense appliance at least contains one or more machine-learning models to analyze the pattern of life data for each endpoint agent connected to that cyber defense appliance. The endpoint agent and the cyber defense appliance may trigger one or more actions to be autonomously taken to contain a detected cyber threat when a cyber-threat risk score is indicative of a likelihood of a cyber-threat is equal to or above an actionable threshold.