Helper agent and system
Aspects of the invention relate to a cyber security system that may enable an end user to communicate with a cyber security appliance to identify cyber threats across the client system. The system can include one or more host devices each having a user interface and an endpoint agent for facilitating bi-directional communication between the user and a cyber security appliance. The endpoint agent may include a communication facilitation module including a user interaction module configured to communicate with the user interface and a helper module configured to communicate with the cyber security appliance. The endpoint agent is configured to enable the bi-directional communication between the user interface and the cyber security appliance on receiving a query associated with identified unusual behavior.
1 . An endpoint agent configured to detect a cyber threat on an endpoint computing device including at least a processor, the endpoint agent comprising:
a communication module configured, upon execution by the processor, to facilitate bi-directional communication between a user interface and a cyber security appliance, the communication module including a user interaction module configured to communicate with the user interface and a helper module configured to communicate with the cyber security appliance;
wherein the helper module is configured to generate an icon on a display of the endpoint computing device that, when selected, enables an end user to initiate a cyber threat analysis on content within a specific electronic mail (email) message, including a uniform resource locator (URL) or other types of link within the email message, for determining whether the content is malicious, wherein the helper module comprises at least a user validation module configured to retrieve contextual information about the end user and issue authentication data to the end user using the contextual information, and
wherein the endpoint agent being configured to enable the bi-directional communication between the user interface and the cyber security appliance on receiving a query associated with identified unusual behavior.
2 . The endpoint agent of claim 1 wherein the endpoint agent is configured to enable (i) the end user of the endpoint computing device to initiate the query or (ii) the cyber security appliance to initiate the query.
3 . The endpoint agent of claim 1 wherein the helper module further comprises at least (i) an endpoint query builder module configured to transform the query for receipt by an application programming interface (API) that interfaces with the cyber security appliance, and (ii) a parser module configured to separate the URL or the other types of link within the email message into a plurality of URL components in human- or machine-readable format.
4 . The endpoint agent of claim 1 wherein the endpoint agent is configured to enable the cyber security appliance to initiate the query based on information associated with another user or internet link identified by the end user, or based on information associated with unusual behavior on the endpoint computing device identified by the cyber security appliance.
5 . The endpoint agent of claim 1 wherein the endpoint agent is configured to obtain, from the end user of the endpoint computing device, contextual information relating to the identified unusual behavior on the endpoint computing device.
6 . The endpoint agent of claim 1 wherein the communication module comprises a cyber security appliance query builder module configured to provide the query to the cyber security appliance.
7 . The endpoint agent of claim 1 wherein the communication module comprises a URL parser module configured to analyse internet links and parse those links into their constituent parts for analysis.
8 . The endpoint agent of claim 1 wherein the communication module comprises a reporting module configured to enable the end user to report unusual behavior to the cyber security appliance.
9 . The endpoint agent of claim 1 wherein the communication module comprises a Natural Language Processing (NLP) module configured to convert natural language into computer-readable language.
10 . The endpoint agent of claim 1 wherein the communication module comprises a behavior feedback module configured to gather information associated with identified unusual behavior on the endpoint computing device.
11 . The endpoint agent of claim 1 wherein the communication module cooperates with one or more classifier modules configured to categorize the identified unusual behavior as either normal or anomalous.
12 . The endpoint agent of claim 11 wherein the communication module cooperates with a database configured to store information associated with identified anomalous behavior.
13 . The endpoint agent of claim 12 wherein the cyber security appliance is configured to use the stored information associated with the identified unusual behavior to classify further identified unusual behaviors.
14 . The endpoint agent of claim 1 wherein the communication module comprises an incident management module configured to retrieve information associated with the unusual behavior on the endpoint computing device from the cyber security application.
15 . The endpoint agent of claim 1 wherein the communication module cooperates with a cyber security appliance server to exchange information relating to the identified unusual behavior on the endpoint computing device with the cyber security appliance.
16 . A cyber security system comprising:
a cyber security appliance; and
a host device having a user interface and an endpoint agent for facilitating bi-directional communication between the user interface and a cyber security appliance, the endpoint agent comprising a communication module including a user interaction module configured to communicate with the user interface and a helper module configured to communicate with the cyber security appliance,
wherein the helper module is configured to generate an icon on a display of the endpoint computing device that, when selected, enables an end user to initiate a cyber threat analysis on content within a specific electronic mail (email) message, including a uniform resource locator (URL) or other types of link within the email message, for determining whether the content is malicious, wherein the helper module comprises at least a user validation module configured to retrieve contextual information about the end user and issue authentication data to the end user using the contextual information, and
wherein the endpoint agent is configured to enable the bi-directional communication between the user interface and the cyber security appliance on receiving a query associated with identified unusual behavior.
17 . The cyber security system of claim 16 wherein the cyber security appliance resides on a cyber security server.
18 . The cyber security system of claim 16 further comprising one or more classification modules.
19 . The cyber security system of claim 16 further comprising a plurality of host devices each having a respective endpoint agent residing thereon, each of the plurality of endpoint agents configured to communicate with the same cyber security appliance.