Endpoint Security Agent: A Comprehensive Approach to Real-Time System Monitoring and Threat Detection
R Srihari, Mohammed Usman Hussain, Karthik Karthik, Ayesha Taranum · 2025
As cyber threats become increasingly sophisticated and regular, strong endpoint protection is important to protect an organization. In this paper, we present "Endpoint Security Agent," a fully modular real-time security framework for Windows systems. The endpoint security agent utilizes several telemetry tools built into Windows, machine-learning techniques including Isolation Forest and tuned LLaMA models, and threat classification identifies based on the MITRE ATT&CK framework. The design is extensible and resource-efficient with minimal impact on the endpoint system. The system uses layered detection, centralized event management, and automated response. Evaluation results indicate that the system shows good results in detecting both known and zero-day threats with efficient use of system resources, and it has an effective application to provide endpoint protection in enterprises.