Dynamic re-distribution of detection content and algorithms for exploit detection

1. A server to improve detection of computer security exploit attacks, the server comprising:

memory;

instructions; and

at least one processor to execute the instructions to:

deploy respective ones of a plurality of standard detection algorithms and content (SDACs) to respective ones of a first endpoint and a second endpoint;

deploy a first set of enhanced detection algorithms and content (EDACs) to the first endpoint, the first set of the EDACs to cause the first endpoint to:

generate behavioral data associated with the first endpoint;

extract a first profile corresponding to the behavioral data; and

identify an exploit attack based on a comparison of the first profile to a second profile, the second profile corresponding to a characteristic of a known exploit attack;

deploy a second set of the EDACs to the second endpoint, the second set of the EDACs different from the first set of the EDACs; and

in response to obtaining a notification indicative of the exploit attack from the first endpoint, distribute the first set of the EDACs to the second endpoint to facilitate detection of the exploit attack at the second endpoint.

2. The server of claim 1 , wherein the at least one processor is to transmit a security policy to the first and the second endpoints, the security policy to cause the first endpoint to request the first set of the EDACs and to cause the second endpoint to request the second set of the EDACs.

3. The server of claim 1 , wherein the at least one processor is to:

determine a type of the exploit attack based on data included in the notification; and

distribute a third set of the EDACs to the first and the second endpoints based on the type of the exploit attack.

4. The server of claim 1 , wherein the at least one processor is to transmit a command to the first endpoint to kill or suspend execution of affected code associated with the exploit attack.

5. The server of claim 1 , wherein the at least one processor is to transmit a command to the first endpoint to move execution of affected code associated with the exploit attack to a protected sandbox of the first endpoint.

6. The server of claim 1 , wherein the at least one processor is to:

deploy the first set of the EDACs to the first endpoint by deploying the first set of the EDACs at a first time; and

in response to not obtaining the notification by a second time, deploy a third set of the EDACs to the first endpoint, the second time after the first time.

7. The server of claim 1 , wherein the at least one processor is an at least one first processor, the first endpoint includes at least one second processor, the behavioral data is based on one or more metrics, and at least one of the first set of the SDACs or the second set of the EDACs are to cause the first endpoint to:

retrieve the one or more metrics from the at least one second processor, the one or more metrics including at least one of a first number of retired instructions, a second number of elapsed core clock ticks, a core frequency, a third number of L2 cache hits, a fourth number of L2 cache misses, a fifth number of L3 cache hits, a sixth number of L3 cache misses, one or more first bytes read from a memory controller, one or more second bytes written to the memory controller, or data traffic transferred by one or more interconnect links; and

generate the first profile based on the one or more metrics.

8. A storage disk or storage device comprising instructions that, when executed, cause at least one processor to at least:

deploy respective ones of a plurality of standard detection algorithms and content (SDACs) to respective ones of a first endpoint and a second endpoint;

deploy a first set of enhanced detection algorithms and content (EDACs) to the first endpoint, the first set of the EDACS to cause the first endpoint to:

generate behavioral data associated with the first endpoint;

extract a first profile corresponding to the behavioral data; and

identify an exploit attack based on a comparison of the first profile to a second profile, the second profile corresponding to a characteristic of a known exploit attack;

deploy a second set of the EDACs to the second endpoint, the second set of the EDACs different from the first set of the EDACs; and

in response to obtaining a notification indicative of the exploit attack from the first endpoint, distribute the first set of the EDACs to the second endpoint to facilitate detection of the exploit attack at the second endpoint.

9. The storage disk or storage device of claim 8 , wherein the instructions, when executed, cause the at least one processor to transmit a security policy to the first and the second endpoints, the security policy to cause the first endpoint to request the first set of the EDACs and to cause the second endpoint to request the second set of the EDACs.

10. The storage disk or storage device of claim 8 , wherein the instructions, when executed, cause the at least one processor to:

determine a type of the exploit attack based on data included in the notification; and

distribute a third set of the EDACs to the first and the second endpoints based on the type of the exploit attack.

11. The storage disk or storage device of claim 8 , wherein the instructions, when executed, cause the at least one processor to transmit a command to the first endpoint to kill or suspend execution of code associated with the exploit attack.

12. The storage disk or storage device of claim 8 , wherein the instructions, when executed, cause the at least one processor to transmit a command to the first endpoint to move execution of code associated with the exploit attack to a protected sandbox of the first endpoint.

13. The storage disk or storage device of claim 8 , wherein the instructions, when executed, cause the at least one processor to:

deploy the first set of the EDACs to the first endpoint by deploying the first set of the EDACs at a first time; and

in response to not obtaining the notification by a second time, deploy a third set of the EDACs to the first endpoint, the second time after the first time.

14. The storage disk or storage device of claim 8 , wherein the at least one processor is an at least one first processor, the first endpoint includes at least one second processor, the behavioral data is based on one or more metrics, and at least one of the first set of the SDACs or the second set of the EDACs are to cause the first endpoint to:

retrieve the one or more metrics from the at least one second processor, the one or more metrics including at least one of a first number of retired instructions, a second number of elapsed core clock ticks, a core frequency, a third number of L2 cache hits, a fourth number of L2 cache misses, a fifth number of L3 cache hits, a sixth number of L3 cache misses, one or more first bytes read from a memory controller, one or more second bytes written to the memory controller, or data traffic transferred by one or more interconnect links; and

generate the first profile based on the one or more metrics.

15. A method to improve detection of computer security exploits, the method comprising:

deploying respective ones of a plurality of standard detection algorithms and content (SDACs) to respective ones of a first endpoint and a second endpoint;

deploying a first set of enhanced detection algorithms and content (EDACs) to the first endpoint;

deploying a second set of the EDACs to the second endpoint, the second set of the EDACs different from the first set of the EDACs;

generating behavioral data associated with the first endpoint;

extracting a first profile corresponding to the behavioral data;

detecting an exploit attack based on a comparison of the first profile to a second profile, the second profile corresponding to a characteristic of a known exploit attack; and

in response to obtaining a notification indicative of the exploit attack from the first endpoint, distributing the first set of the EDACs to the second endpoint to facilitate detection of the exploit attack at the second endpoint.

16. The method of claim 15 , further including transmitting a security policy to the first and the second endpoints, the security policy to cause the first endpoint to request the first set of the EDACs and to cause the second endpoint to request the second set of the EDACs.

17. The method of claim 15 , further including:

determining a type of the exploit attack based on data included in the notification; and

distributing a third set of the EDACs to the first endpoint based on the type of the exploit attack.

18. The method of claim 15 , further including transmitting a command to the first endpoint to at least one of:

kill or suspend execution of code associated with the exploit attack; or

move execution of the code associated with the exploit attack to a protected sandbox of the first endpoint.

19. The method of claim 15 , further including:

deploying the first set of the EDACs to the first endpoint by deploying the first set of the EDACs at a first time; and

in response to not obtaining the notification by a second time, deploying a third set of the EDACs to the first endpoint, the second time after the first time.

20. The method of claim 15 , wherein the first endpoint includes at least one processor, the behavioral data is based on one or more metrics, and the method further including:

retrieving the one or more metrics from the at least one processor, the one or more metrics including at least one of a first number of retired instructions, a second number of elapsed core clock ticks, a core frequency, a third number of L2 cache hits, a fourth number of L2 cache misses, a fifth number of L3 cache hits, a sixth number of L3 cache misses, one or more first bytes read from a memory controller, one or more second bytes written to the memory controller, or data traffic transferred by one or more interconnect links; and

generating the first profile based on the one or more metrics.