🤖 AI Summary
This work addresses the challenge faced by small and resource-constrained organizations in affording the high costs and operational complexity of commercial endpoint detection and response (EDR) systems by proposing a lightweight, open-source EDR solution based on a three-tier client-server architecture. The system employs a Flutter- and Kotlin-based endpoint agent and a Node.js-powered central server, ensuring secure communication through WebSocket Secure (WSS), JSON Web Token (JWT) authentication, and HMAC. Threat detection is achieved via a static signature database. Experimental evaluation demonstrates that the system achieves an average command latency of approximately 1.5 seconds under 50 concurrent endpoints, enabling sub-second responsiveness while effectively mitigating invalid token usage, SQL injection, and replay attacks. These results confirm its practical value in delivering low overhead, strong security, and ease of deployment.
📝 Abstract
Endpoint devices remain a primary target for cyberattacks, yet commercial Endpoint Detection and Response (EDR) platforms are often too costly and operationally complex for small and resource-constrained organizations. This paper presents SafeGuard, a lightweight three-tier client-server architecture for real-time endpoint monitoring, threat reporting, and administrative response. The system comprises a Flutter-based endpoint agent extended with Kotlin for Android system access, a Node.js central server that authenticates devices and coordinates secure communication, and an administrative dashboard for live monitoring and remote actions such as device locking, application removal, and warning notification dispatch. Threat detection is implemented through signature-based comparison against a maintained threat database, prioritizing low computational overhead, explainability, and ease of deployment over generalized anomaly detection. Communication security is achieved using WebSocket over TLS (WSS), JSON Web Token (JWT) authentication, and HMAC-based message integrity verification. The system was evaluated through unit, integration, system, load, and preliminary security testing. Under a simulated deployment of 50 concurrent endpoints, average command-dispatch latency was approximately 1.5 seconds and remained below 2 seconds under load. Invalid authentication tokens were rejected, while manual SQL injection and replay attempts were unsuccessful in the evaluated scenarios. The results demonstrate that an open-source technology stack can provide real-time endpoint visibility and coordinated administrative response without commercial licensing costs. The contribution is architectural and empirical rather than algorithmic, with current limitations including reliance on static threat signatures, Android-focused implementation, and controlled-environment evaluation.