Agent prevention augmentation based on organizational learning

An endpoint computing device, comprising:

• a memory configured to store a security agent;
• and
• a processor configured to execute the security agent so as to detect an event of given event type associated with suspicious behavior occurring in execution of a software process by the endpoint computing device, to convey a query with respect to the event type over a network from the security agent to a security server, to receive, from the security server in response to the query, context information with respect to the event type based on collation of event reports from multiple endpoint computing devices,
• wherein the security agent is configured to extract one or more features from the detected event, to make a real-time decision whether to block the suspicious behavior on the endpoint computing device based on the context information received from the security server and the one or more features extracted by the security agent, wherein the context information comprises a profile for the given event type, the profile comprising a set of profile features and a corresponding set of feature weights, wherein the feature weights are determined based on at least one of a frequency and a recency of the profile features in event records, and wherein making the real-time decision comprises computing a suspiciousness score by applying the feature weights to the one or more features extracted from the detected event, wherein less frequent or less recent feature combinations are weighted to produce a higher suspiciousness score, and to initiate a protective action by the security agent on the endpoint computing device in response to the decision.

A computer software product, comprising a non-transitory computer-readable medium, in which program instructions are stored, which instructions, when read by a processor in an endpoint computing device, cause the processor to execute a security agent so as to detect an event of given event type associated with suspicious behavior occurring in execution of a software process by the endpoint computing device, to convey a query with respect to the event type over a network from the security agent to a security server, to receive, from the security server in response to the query, context information with respect to the event type based on collation of event reports from multiple endpoint computing devices,

• wherein the instructions cause the security agent to extract one or more features from the detected event, to make a real-time decision whether to block the suspicious behavior on the endpoint computing device based on the context information received from the security server and the one or more features extracted by the security agent, wherein the context information comprises a profile for the given event type, the profile comprising a set of profile features and a corresponding set of feature weights, wherein the feature weights are determined based on at least one of a frequency and a recency of the profile features in event records, and wherein making the real-time decision comprises computing a suspiciousness score by applying the feature weights to the one or more features extracted from the detected event, wherein less frequent or less recent feature combinations are weighted to produce a higher suspiciousness score, and to initiate a protective action by the security agent on the endpoint computing device in response to the decision.