Saved in:
| Main Authors: | , , , |
|---|---|
| Format: | Preprint |
| Published: |
2025
|
| Subjects: | |
| Online Access: | https://arxiv.org/abs/2511.08352 |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866909898372022272 |
|---|---|
| author | R, Srihari Taranum, Ayesha Karthik Hussain, Mohammed Usman |
| author_facet | R, Srihari Taranum, Ayesha Karthik Hussain, Mohammed Usman |
| contents | As cyber threats continue to evolve in complexity and frequency, robust endpoint protection is essential for organizational security. This paper presents "Endpoint Security Agent: A Comprehensive Approach to Real-time System Monitoring and Threat Detection" a modular, real-time security solution for Windows endpoints. The agent leverages native tools like WMI and ETW for lowlevel monitoring of system activities such as process execution, registry modifications, and network behaviour. A machine learning-based detection engine, trained on labelled datasets of benign and malicious activity, enables accurate threat identification with minimal false positives. Detection techniques are mapped to the MITRE ATT&CK framework for standardized threat classification. Designed for extensibility, the system includes a centralized interface for alerting and forensic analysis. Preliminary evaluation shows promising results in detecting diverse attack vectors with high accuracy and efficiency. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2511_08352 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | Endpoint Security Agent: A Comprehensive Approach to Real-time System Monitoring and Threat Detection R, Srihari Taranum, Ayesha Karthik Hussain, Mohammed Usman Cryptography and Security As cyber threats continue to evolve in complexity and frequency, robust endpoint protection is essential for organizational security. This paper presents "Endpoint Security Agent: A Comprehensive Approach to Real-time System Monitoring and Threat Detection" a modular, real-time security solution for Windows endpoints. The agent leverages native tools like WMI and ETW for lowlevel monitoring of system activities such as process execution, registry modifications, and network behaviour. A machine learning-based detection engine, trained on labelled datasets of benign and malicious activity, enables accurate threat identification with minimal false positives. Detection techniques are mapped to the MITRE ATT&CK framework for standardized threat classification. Designed for extensibility, the system includes a centralized interface for alerting and forensic analysis. Preliminary evaluation shows promising results in detecting diverse attack vectors with high accuracy and efficiency. |
| title | Endpoint Security Agent: A Comprehensive Approach to Real-time System Monitoring and Threat Detection |
| topic | Cryptography and Security |
| url | https://arxiv.org/abs/2511.08352 |