Endpoint Query Engine for Distributed Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current endpoint detection and response systems have limited functionality in filtering and processing unstructured, dynamic data, making it difficult to detect and mitigate advanced persistent threats and malware, especially in large enterprise networks with thousands of endpoints, where traditional antivirus solutions are often ineffective.
Innovation Solution
A query engine is implemented on endpoints to process complex queries, filter data, and execute dynamic scripts, allowing for real-time data retrieval and analysis, even when endpoints are offline, reducing network bandwidth and enabling proactive security measures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If traditional antivirus solutions are used in large enterprise networks, then network infrastructure is simple, but detection capability for advanced persistent threats and malware is insufficient
Solution Approach 1:
The system segments security functions by deploying query engines at individual endpoint devices rather than relying solely on centralized infrastructure. Each endpoint can independently execute queries to search for threats, dividing the detection task across multiple devices to improve detection capability without overburdening the central network infrastructure.
Solution Approach 2:
The query engine acts as an intermediary component deployed at each endpoint, mediating between the endpoint's local data and the centralized query service. This intermediary enables sophisticated detection capabilities at the endpoint level while maintaining network infrastructure simplicity through standardized query protocols.
2Productivity
If complex queries are processed at centralized servers, then query processing capability is strong, but network bandwidth consumption increases and response time increases
Solution Approach 1:
The query processing function is segmented between centralized servers and distributed endpoint devices. Simple queries can be processed centrally, while complex queries are executed locally at endpoints using the deployed query engines, reducing the amount of data that needs to traverse the network and lowering bandwidth consumption.
Solution Approach 2:
Query engines are pre-deployed at endpoints before complex analysis is needed. When a security event occurs, the pre-positioned query engines can immediately execute queries locally to search for related threats, eliminating the need to wait for centralized processing and reducing network bandwidth requirements for data transfer.
3Speed
If real-time data retrieval is enabled at endpoints, then security response speed improves, but endpoint device resources are consumed
Solution Approach 1:
The query engine is designed with local quality optimization, executing queries using the endpoint's local resources for speed-critical operations while only consuming additional resources when necessary. The engine can operate in modes that balance between using minimal local resources for rapid responses versus more resource-intensive analysis, adapting to the specific security scenario.
Data Source
AI summary
Embodiments are disclosed herein for remote retrieval of information from endpoints and comprise receiving a master query at an endpoint in a network environment and executing a set of one or more subqueries defined in the master query. Embodiments also comprise an execution of a first subquery that includes executing a function to produce a first output, applying one or more conditions to the first output to determine a second output, and determining a result of the master query based, at least in part, on the second output. In specific embodiments, the master query is received from another node over a network connection. In more specific embodiments, the function is executed on the endpoint to collect real-time information based on one or more parameters. In further embodiments, the function is one of a plug-in or a script.