Resilient management of resource utilization

1. A computational system comprising:

a. a plurality of endpoint devices each comprising:

1) a processor;

2) an operating system;

3) a computer memory; and

4) instructions stored in the memory and executable by the processor for defining (i) a plurality of user applications, (ii) a plurality of sensors for monitoring calls to the operating system, (iii) a plurality of actuators for causing the processor to take specified actions for mitigating a threat or anomaly, and (iv) an intelligent controller for analyzing successive time windows of sensor data from the sensors based on a predictive response model to detect anomalous behavior, and upon detecting such behavior, instructing an actuator to take a specified mitigation action; and

b. a network aggregator comprising for receiving data from the intelligent controllers of the endpoint devices, the received data including sensor data and data characterizing anomalous behavior detected by the predictive response models of the intelligent controllers, the network aggregator comprising:

1) a processor;

2) a computer memory for storing executable instructions and the predictive response models of the endpoint devices; and

3) instructions stored in the memory and executable by the processor for (i) updating at least some of the predictive response models based at least in part on data received from a plurality of intelligent controllers and (ii) communicating the updated predictive response models back to the associated intelligent controllers.

2. The system of claim 1 , wherein the sensors each include a classifier for assessing a risk associated with the monitored calls to the operating system.

3. The system of claim 2 , wherein the classifier is a Bayes classifier.

4. The system of claim 1 , wherein each of the applications running on an endpoint device is associated with a unique sensor and a unique actuator, each of the sensors monitoring the calls to the operating system using an API shim.

5. The system of claim 1 , wherein the intelligent controllers are configured to assess, after instructing an actuator to take a specified mitigation action, a degree of effectiveness of the mitigation action.

6. The system of claim 5 , wherein the data received by the network aggregator from the intelligent controllers includes the degree of effectiveness of the mitigation actions.

7. The system of claim 1 , wherein the predictive response models of the intelligent controllers are machine-learning models.

8. The system of claim 7 , wherein at least some of the machine-learning models include a supervised learning algorithm.

9. The system of claim 7 , wherein at least some of the machine-learning models include an unsupervised learning algorithm.

10. The system of claim 1 , wherein the predictive response models are user-specific.

11. The system of claim 10 , wherein each endpoint device further comprises a user database having fields for applications hosted by the endpoint device, permitted users for each application, and for each user, a pointer or link to a user-specific predictive model.

12. The system of claim 10 , wherein the network aggregator is configured to update the predictive response models based on received sensor data as well as user behavior and privilege levels.

13. A computational method comprising the steps of:

at a plurality of endpoint devices, executing a plurality of user applications and executing (i) a sensor associated with each of the applications, the sensor for an application monitoring calls to the operating system by the associated application and generating data indicative of the calls, (ii) an actuator associated with each of the applications for taking actions to mitigate a threat or anomaly, and (iii) an intelligent controller for analyzing successive time windows of sensor data from the sensors based on a predictive response model to detect anomalous behavior, and upon detecting such behavior, instructing an actuator to take a specified mitigation action; and

at a network aggregator, receiving data from the intelligent controllers of the endpoint devices, the received data including sensor data and data characterizing anomalous behavior detected by the predictive response models of the intelligent controllers, the network aggregator (i) updating at least some of the predictive response models based at least in part on data received from a plurality of intelligent controllers and (ii) communicating the updated predictive response models back to the associated intelligent controllers.

14. The method of claim 13 , further comprising executing, by the sensors, a classifier for assessing a risk associated with the monitored calls to the operating system.

15. The method of claim 14 , wherein the classifier is a Bayes classifier.

16. The method of claim 13 , wherein each of the sensors monitors the calls to the operating system using an API shim.

17. The method of claim 13 , further comprising assessing, by the intelligent controllers after instructing an actuator to take a specified mitigation action, a degree of effectiveness of the mitigation action.

18. The method of claim 17 , wherein the data received by the network aggregator from the intelligent controllers includes the degree of effectiveness of the mitigation actions.

19. The method of claim 13 , wherein the predictive response models of the intelligent controllers are machine-learning models.

20. The method of claim 19 , wherein at least some of the machine-learning models include a supervised learning algorithm.

21. The method of claim 20 , wherein at least some of the machine-learning models include an unsupervised learning algorithm.

22. The method of claim 13 , wherein the predictive response models are user-specific.

23. The method of claim 13 , further comprising updating the predictive response models based on received sensor data as well as user behavior and privilege levels.