Runtime Sensor Event Aggregation for Cloud EDR Bandwidth Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing endpoint detection and response (EDR) solutions for cloud computing environments face challenges due to the high resource usage of agent-based methods and the incomplete detection of agentless solutions, leading to inefficiencies and undetected cybersecurity threats.
Innovation Solution
A system utilizing a runtime sensor to detect and aggregate runtime data, generating unmerged event records, and applying policies for real-time threat detection and response, reducing resource usage and enhancing detection efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If agent based solutions are used to detect cybersecurity threats, then detection completeness is improved, but resource consumption increases
Solution Approach 1:
The patent introduces a runtime sensor as an intermediary component that collects runtime data from the endpoint and forwards it to the analysis system. This mediator approach allows comprehensive threat detection without requiring the endpoint itself to perform heavy analysis, thus maintaining detection completeness while reducing resource consumption at the endpoint.
Solution Approach 2:
The patent extracts the heavy computational workload from the endpoint by separating data collection (performed by lightweight runtime sensor at endpoint) from data analysis (performed by backend system). This extraction allows the endpoint to maintain full detection capability while consuming minimal local resources.
2Speed
If agent based solutions are deployed on endpoint machines, then real-time detection capability is improved, but device complexity increases
Solution Approach 1:
The runtime sensor acts as a simple intermediary that collects and forwards data without requiring complex local processing logic. This maintains real-time detection capability while keeping the endpoint device complexity low.
3Reliability
If agent based solutions require root privileges or privileged software container, then detection capability is improved, but security risk increases
Solution Approach 1:
The runtime sensor serves as a privileged intermediary that collects data on behalf of the analysis system. By concentrating privileges in the sensor rather than requiring full agent privileges, the system maintains detection capability while reducing security risk through minimized privilege exposure.
4Use of energy by moving object
If agentless solutions are used to reduce resource usage, then resource consumption is reduced, but detection completeness deteriorates
Solution Approach 1:
The runtime sensor acts as a lightweight intermediary that provides agentless deployment benefits while maintaining comprehensive data collection capabilities, thus achieving both low resource consumption and complete threat detection.
Data Source
AI summary
A system and method for improved endpoint detection and response (EDR) in a cloud computing environment by decreasing network bandwidth usage are presented. The method includes: configuring a resource in a cloud computing environment to deploy thereon a runtime sensor, the runtime sensor configured to detect runtime data of the resource; configuring the runtime sensor to detect in the runtime data a plurality of events, each event sharing a common value; configuring the runtime sensor to generate an aggregated event record based on the detected plurality of events having a common value; receiving the aggregated event record from the runtime sensor; generating a plurality of unmerged event records based on the aggregated event record; and storing the unmerged event records in a cloud computing storage.