Distributed digital security system
摘要
說明書
For example, some digital security systems only execute locally on individual computing devices. While this can be useful in some cases, local-only digital security systems may miss broader patterns of events associated with security threats that occur across a larger set of computing devices. For instance, an attacker may hijack a set of computing devices and cause each one to perform events that are innocuous individually, but that cause harmful results on a network, server, or other entity when the events from multiple computing devices are combined. Local-only security systems may accordingly not be able to detect a broader pattern of events across multiple computing devices.
Some digital security systems do cause event data to be reported to servers or other network elements, such that network and/or cloud processing can be used to analyze event data from one or more computing devices. However, many such cloud-based systems can become overloaded with event data reported by individual computing devices, much of which may be noise and thus be irrelevant to security threat detection. For example, many systems do not have ways of limiting the event data that is initially reported to the cloud. Many systems also do not provide indications to the cloud about reasons why specific event data has been sent to the cloud.
