Multi-stage anomaly detection for process chains in multi-host environments

A method for detecting one or more potential cyber threats on an endpoint computing device, comprising:

• configuring a host endpoint agent to reside on the endpoint computing device, wherein the host endpoint agent is configured to communicate with a cyber security appliance;
• training an analyzer module in the host endpoint agent based on one or more machine-learning models trained on the endpoint computing device;
• generating one or more anomaly scores for a potential cyber threat detected on the host endpoint agent based on the trained analyzer module, wherein the trained analyzer module includes a multi-stage anomaly detector, wherein the multi-stage anomaly detector includes two or more stages of anomaly detectors;
• generating, by at least a first and a second stage of the multi-stage anomaly detector, a particular anomaly score from the one or more generated anomaly scores for a process chain of parameters under analysis by that stage of the multi-stage anomaly detector, wherein the first stage of the multi-stage anomaly detector has a different amount of time duration in order to produce its anomaly score from another stage of the multi-stage anomaly detector;
• and
• correlating the anomaly score to a likelihood that the detected potential cyber threat is maliciously harmful for the endpoint computing device, and, when a maliciously harmful cyber threat is detected, then generating at least a notice to a user of the endpoint computing device.