Runtime Telemetry Monitoring for Proactive Endpoint Threat Mitigation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Traditional endpoint security solutions rely heavily on signature-based detection, which is reactive and ineffective against new or modified threats, leading to increased attack surfaces and vulnerabilities due to software creep and lack of proactive risk assessment.

Innovation Solution

Implementing a client-side monitoring agent that collects runtime telemetry data to analyze software behavior, detects security risks, and performs remedial actions, such as terminating programs or blocking functions, while providing continuous monitoring and risk scoring.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If signature-based detection is used, then known threats can be identified, but new or modified threats cannot be detected and system performance decreases

Engineering Contradiction:

Improvethreat detection capabilityVSAvoidendpoint performance

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent replaces signature-based mechanical detection with runtime telemetry analysis that monitors actual software behavior patterns. Instead of relying on pre-defined signatures, the system collects telemetry data about software execution, system calls, and behavior patterns to detect threats based on anomalous activity, thereby maintaining performance while improving detection of new threats

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The system changes the detection parameters from static signatures to dynamic runtime behavior parameters. By monitoring parameters such as execution timing, system calls, memory access patterns, and process relationships during runtime, the system can detect new and modified threats without the performance penalty of continuous signature scanning

Inventive Principle:

Principle #35Parameter changes

2Reliability

If active scanning and monitoring techniques are implemented, then threat detection improves, but system resources are consumed and performance decreases

Engineering Contradiction:

Improvethreat detection capabilityVSAvoidsystem resource consumption

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent implements partial monitoring by selectively collecting runtime telemetry data only for software processes that are currently executing or show suspicious behavior patterns. Rather than continuously monitoring all software components, the system focuses resources on active processes and those exhibiting anomalous behavior, reducing overall resource consumption while maintaining effective threat detection

Inventive Principle:

Principle #16Partial or excessive action

Solution Approach 2:

The monitoring agent performs self-adjustment by learning normal software behavior patterns and automatically determining which processes require monitoring based on risk assessment. The system prioritizes monitoring of high-risk software while reducing or eliminating monitoring of trusted applications, thereby reducing resource consumption without compromising security

Inventive Principle:

Principle #25Self-service

3Reliability

If traditional endpoint protection is used, then known vulnerabilities are addressed, but software creep increases and proactive risk assessment is unavailable

Engineering Contradiction:

Improvesecurity protectionVSAvoidproactive risk assessment capability

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The system implements continuous feedback loops where runtime telemetry data is collected, analyzed, and used to update risk assessments of software processes. The monitoring agent provides feedback about actual behavior patterns to security decision-making processes, enabling proactive identification of risks before they manifest as detected threats, thus addressing software creep and enabling forward-looking security

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS20260073039A1Endpoint threat mitigation based on runtime telemetry data

Publication Date: 2026.03.12 SPEKTION INC

AI summary

Disclosed herein are methods and systems for improving endpoint device security. An agent deployed to the endpoint device may inject monitoring code into a program during runtime of the program. The monitoring code instructs the program to generate runtime telemetry data. The agent may detect behavior indicative of a security risk based on the runtime telemetry data. The agent may automatically perform at least one remedial action of a plurality of remedial actions, wherein the plurality of remedial actions comprises: notifying a user of the endpoint device of the behavior indicative of the security risk, terminating the program, blocking one or more functions of the program, and reporting the behavior indicative of the security risk to a server system.