Kernel Event Telemetry Filters with JIT Threat Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing endpoint security systems face inefficiencies in processing large volumes of event log data, lacking the ability to selectively filter and process only relevant events, leading to increased storage and processing demands.

Innovation Solution

Implementing telemetry filters at the endpoint level, including a kernel-level event tracing facility, event manager, and detection engine, with just-in-time compilation to evaluate filters in memory, reducing data processing by selectively capturing and filtering events of interest.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If all event log data is collected and sent to central database for analysis, then comprehensive security monitoring is achieved, but data processing loads and storage demands increase significantly

Engineering Contradiction:

Improvecomprehensive security monitoringVSAvoiddata processing loads

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent implements telemetry filters at the local endpoint level rather than centrally, allowing each endpoint to selectively filter events based on local conditions and priorities. This distributes the filtering workload and reduces the volume of data that needs to be processed centrally, resolving the contradiction between comprehensive monitoring and processing load.

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The patent segments the event processing function into multiple components: local telemetry filters at endpoints, selective event sampling, and centralized analysis. This segmentation allows filtering to occur at the source, reducing the data volume transmitted and processed centrally while maintaining comprehensive security coverage.

Inventive Principle:

Principle #1Segmentation

2Productivity

If telemetry filters are implemented at endpoint level with just-in-time compilation, then data processing efficiency is improved, but device complexity increases

Engineering Contradiction:

Improvedata processing efficiencyVSAvoidendpoint agent complexity

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The patent uses just-in-time compilation to pre-compile filter expressions into optimized machine code before execution. This preliminary action transforms high-level filter definitions into efficient executable code, improving processing efficiency while keeping the endpoint agent's runtime complexity manageable through compiler optimization.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent replaces interpretive filtering mechanisms with compiled machine code execution. This substitution of the filtering mechanism from interpretation to native compilation significantly improves processing efficiency while the complexity is managed through automated compilation tools rather than manual optimization.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Quantity of substance

If selective event filtering is implemented, then data transmission volume is reduced, but measurement precision of security events may be compromised

Engineering Contradiction:

Improvedata transmission volumeVSAvoidevent detection accuracy

Core Design Contradiction:

Quantity of substanceVSMeasurement precision

Solution Approach 1:

The patent implements dynamic filter configuration where telemetry filters can be adjusted based on detected threats, historical data, and system conditions. This dynamic approach allows the system to maintain high detection accuracy by adapting filter criteria while optimizing data transmission volume based on current security context.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The patent incorporates feedback mechanisms where filter performance and detection accuracy are continuously monitored and used to adjust filter criteria. This feedback loop ensures that selective filtering maintains measurement precision by learning from actual security events and optimizing filter parameters over time.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS20250240311A1Endpoint security systems and methods with telemetry filters for event log monitoring

Publication Date: 2025.07.24 OPEN TEXT CORPORATION

AI summary

An endpoint agent is enhanced with a kernel-level event tracing facility, an event manager having telemetry filters, a persistence manager, and a detection engine. The endpoint agent receives an instruction from a controller system to enable a selection of filters, including a custom-built telemetry filter for the kernel-level event tracing facility which feeds events to the event manager as they are occurring. The event manager determines which enabled telemetry filters are applicable to the events, apply them to identify events of interest, and provide those events to the detection engine which, in turn, applies detection filters to the events of interest to detect possible threats to the endpoint. The telemetry filters are evaluated in memory as the events are occurring. To increase the speed of processing, expression trees representing the telemetry filters can be compiled into machine code just in time of execution. The machine code executes extremely fast natively.