Data mining algorithms adopted for trusted execution environment

A storage disk or storage device comprising instructions that, when executed, cause an endpoint to at least:

• extract first events from process behaviors performed by the endpoint using endpoint rules from one or more servers, at least one of the first events corresponding to a call to an operating system of the endpoint;
• generate a first event sequence by arranging two or more of the first events into the first event sequence;
• generate a third event sequence to determine a correlation fit by attempting to correlate the first event sequence to stored second event sequences of an endpoint ontology model from the one or more servers by applying a hidden Markov model to the first event sequence and the second event sequences of the endpoint ontology model, the second event sequences corresponding to known attack patterns, the third event sequence including second events, one or more of the second events being different from one or more of the first events;
• generate a security alert when the correlation fit satisfies a threshold;
• and
• transmit security event data associated with the security alert to the one or more servers to facilitate an update of the endpoint ontology model to identify a future attack.

An endpoint for detecting threats in a computer network, the endpoint comprising:

• one or more processors;
• and
• memory including instructions that, when executed, cause the one or more processors to:
• extract first events from process behaviors performed by the endpoint using endpoint rules from one or more servers, at least one of the first events corresponding to a call to an operating system of the endpoint;
• generate a first event sequence by arranging two or more of the first events into the first event sequence;
• generate a third event sequence to determine a correlation fit by attempting to correlate the first event sequence to stored second event sequences of an endpoint ontology model from the one or more servers by applying a hidden Markov model to the first event sequence and the second event sequences of the endpoint ontology model, the second event sequences corresponding to known attack patterns, the third event sequence including second events, one or more of the second events being different from one or more of the first events;
• generate a security alert when the correlation fit satisfies a threshold;
• and
• transmit security event data associated with the security alert to the one or more servers to facilitate an update of the endpoint ontology model to detect suspicious behavior patterns at one or more of a plurality of endpoints including the endpoint.

A method of detecting threats in a computer network, the method comprising:

• extracting first events from process behaviors performed by an endpoint using endpoint rules from one or more servers, at least one of the first events corresponding to a call to an operating system of the endpoint;
• generating a first event sequence by arranging ones of the first events into the first event sequence;
• generating a third event sequence to determine a correlation fit by attempting to correlate the first event sequence to stored second event sequences of an endpoint ontology model from the one or more servers by applying a hidden Markov model to the first event sequence and the second event sequences of the endpoint ontology model, the second event sequences corresponding to known attack patterns, the third event sequence including second events, one or more of the second events being different from one or more of the first events;
• and
• when the correlation fit satisfies a threshold, transmitting security event data to the one or more servers to facilitate an update of the endpoint ontology model to identify a future attack at one or more of a plurality of endpoints including the endpoint.