💻 computer science

A microservices-based endpoint monitoring platform with predictive NLP models for real-time security and hate-speech risk alerting

This paper proposes a scalable, microservices-based platform that integrates endpoint telemetry with predictive NLP models to provide real-time, unified alerting for data leakage, suspicious behavior, and hate speech.

Original authors: Darlan Noetzold, Anubis Graciela De Moraes Rossetto, Juan Francisco De Paz Santana, Valderi Reis Quietinho Leithard

Published 2026-05-13

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Darlan Noetzold, Anubis Graciela De Moraes Rossetto, Juan Francisco De Paz Santana, Valderi Reis Quietinho Leithard

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a busy office building where employees use computers to do their jobs. The company wants to protect its secrets (like customer data) and ensure everyone is treated with respect (no bullying or hate speech). However, checking every single computer manually is impossible, and existing security tools often work in silos—one tool checks for stolen data, while another checks for bad language, but they never talk to each other.

This paper presents a new, unified "smart security guard" system designed to solve this problem. Here is how it works, broken down into simple parts:

1. The "Digital Bodyguard" (The Spyware Agent)

Think of the software installed on each employee's computer as a silent, digital bodyguard. It doesn't just watch; it listens and looks at everything happening on the screen.

What it does: It keeps a log of every key you type, watches the websites you visit, checks what programs are running, and even takes a quick "snapshot" of your screen if something looks suspicious.
The Magic: It's incredibly light. The paper claims this bodyguard is so efficient that it uses less than 1% of your computer's power. It's like having a security guard who is so quiet and fast they don't even make the floor creak.

2. The "Central Command" (The Microservices Platform)

All the information from these digital bodyguards needs to go somewhere to be analyzed. The authors built a "Central Command" using a microservices architecture.

The Analogy: Imagine a busy airport. Instead of one giant control tower trying to handle every plane, landing, and passenger at once, you have specialized teams: one team handles luggage, another handles fuel, and another handles security. They all talk to each other instantly.
How it works here: The system uses a "messenger" (RabbitMQ) to pass notes between these specialized teams and a "fast memory shelf" (Redis) to keep things moving quickly. This ensures that even if thousands of employees are sending data at once, the system doesn't crash or slow down.

3. The "Language Detective" (Predictive NLP Models)

This is the most unique part of the system. The "bodyguard" catches typed words and sends them to a Language Detective.

The Job: The detective reads the text to see if it contains hate speech, bullying, or offensive language.
The Tools: The system uses three different types of "detectives" (Logistic Regression, Support Vector Machines, and Multinomial Naive Bayes) trained on millions of examples of text in English, Spanish, and Portuguese.
The Backup Plan: If the standard detectives are unsure, the system calls in a "Super Detective" (GPT-3) to double-check. If the Super Detective finds something the others missed, the system learns from it for next time.
The Result: The paper reports that these detectives are about 87% accurate at spotting hate speech.

4. The "Alarm System" (Real-Time Alerts)

When the system spots a problem—like someone trying to steal a file or typing a hateful message—it doesn't wait.

The Process: It instantly calculates a "risk score." If the score is high enough, it triggers an alarm.
The Evidence: It doesn't just say "Something is wrong." It saves the evidence: a list of running programs, the screen snapshot, and the specific text, all packaged together.
The Dashboard: A manager can log into a web dashboard to see these alerts in real-time. They can filter by who, when, or what type of problem occurred.

5. The "Proof of Integrity" (Security Features)

The paper emphasizes that this system is built to be trustworthy and secure.

Tamper-Proof: If an alert is generated, the system creates a digital "fingerprint" (a cryptographic hash) for it. This is like sealing an envelope with wax; if anyone tries to open or change the contents later, the seal breaks, and the system knows the evidence has been tampered with.
Safety Checks: The authors tested the system against hackers trying to break in (using SQL injection and other tricks). The system successfully blocked these attacks, proving it is safe to use.

The Bottom Line

The paper claims to have built a single, all-in-one platform that does two things at once:

Protects Data: Stops people from stealing sensitive information.
Protects People: Stops hate speech and harassment in the workplace.

The authors tested this system and found it to be fast (responding in less than a second), lightweight (not slowing down computers), and accurate (catching most bad behavior). They argue that by combining these tools, companies can create a safer, more secure, and more inclusive workplace without needing a dozen different, clunky software programs.

Technical Summary: A Microservices-Based Endpoint Monitoring Platform with Predictive NLP Models

Problem Statement

Organizations face a dual challenge in the modern digital landscape: the risk of sensitive data leakage and the circulation of hateful or harmful language within workplace communication channels. Current solutions often address these issues in isolation—separating productivity tracking, data loss prevention (DLP), and hate-speech detection—which limits the ability to correlate signals across different data sources and delays incident response. Furthermore, the rise of remote work and the legal ramifications of hostile work environments (e.g., significant damages awarded in cases like the Tesla lawsuit) necessitate a proactive, integrated approach to monitoring that balances security, compliance, and employee well-being without compromising system performance.

Methodology

The proposed solution is a unified, microservices-based framework designed to collect endpoint telemetry and apply predictive Natural Language Processing (NLP) models for real-time alerting. The methodology follows a requirements-driven engineering approach, structured into four stages: requirements elicitation, architectural design, implementation, and evaluation.

Architecture and Components

The system is built on a modular architecture comprising three primary layers:

Endpoint Layer (Spyware Agent): A Python-based monitoring agent compiled into an executable. It operates via multi-threading to capture:
- Network Traffic: Real-time DNS packet inspection to identify blocked sites or malicious queries.
- Keystrokes: Keylogging to capture typed text for content analysis.
- Processes: Scanning for malicious processes based on administrator-defined lists.
- Ports: Scanning for open ports and vulnerable service banners.
- Screen Capture: Taking screenshots upon alert generation for evidentiary context.
- Decision Logic: Alerts are triggered based on a weighted risk score ( $S(t)$ ) derived from binary indicators (e.g., blocked DNS, prohibited keywords, malicious processes).
Service Orchestration Layer (API Gateway & Backend):
- Central API: Built with Spring Boot and containerized via Docker, managing data flow between components.
- Data Management: Uses PostgreSQL for persistent storage (alerts, user data, images) and Redis for low-latency caching of frequent queries (TTL of 20 seconds).
- Asynchronous Processing: RabbitMQ handles event ingestion and routing, decoupling the ingestion of telemetry from the processing of alerts and classification tasks.
- Optimizations: The system employs lazy initialization, disables unnecessary auto-configurations, utilizes the Undertow servlet container for non-blocking I/O, and implements sequential database indexing to minimize resource overhead.
Predictive NLP Pipeline:
- Data Processing: Text undergoes normalization (lowercasing, cleaning, stopword removal, stemming/lemmatization) and is vectorized using TF-IDF.
- Models: Three traditional machine learning models were trained and evaluated for each language (Portuguese, Spanish, English): Logistic Regression (with L1 regularization), Support Vector Machine (RBF kernel), and Multinomial Naive Bayes (with Laplace smoothing).
- Fallback Mechanism: The system integrates GPT-3 (via the text-davinci-003 model) as a secondary verification layer for phrases not flagged by the primary models. Discrepancies are logged for future retraining.
- Classification: The pipeline identifies the language of the input, applies the corresponding model, and returns a structured JSON classification.

Front-End and Governance

A responsive web application allows administrators to manage blacklists, view alerts, and configure policies. It includes role-based access control, secure session management, and a feature for users to generate cryptographically signed (SHA-256) JSON logs of alerts to ensure auditability and data integrity.

Key Contributions

The paper presents three primary contributions:

Unified Architecture: A modular microservices framework that integrates endpoint monitoring (keylogging, network sniffing, process auditing) with predictive NLP in a single pipeline, addressing the gap in fragmented solutions.
Real-Time Alert Orchestration: A scalable system utilizing RabbitMQ and Redis to handle high-volume data ingestion and deliver low-latency alerts, capable of detecting data exfiltration indicators and policy violations simultaneously.
Multilingual Hate-Speech Detection: The application of transformer-based and traditional ML models to detect hate speech risk indicators across Portuguese, Spanish, and English, achieving high accuracy while maintaining computational efficiency suitable for real-time corporate environments.

Experimental Results

The system was evaluated in a controlled environment (Intel i5-3470, 8GB RAM, Kali Linux) using Docker containers.

Performance and Scalability:
- Spyware Agent: Demonstrated a negligible footprint, with CPU and memory utilization consistently below 1% during sustained monitoring.
- Latency: The total detection cycle (local capture to API classification) averaged approximately 700 ms. The Spyware API Gateway achieved an average inference response time of 500 ms.
- Scalability: Linear regression analysis of load tests (up to 10,000 parallel requests) showed a strong linear correlation between request volume and resource usage (CPU, memory, response time). The system maintained response times under the 1-second threshold even at high loads, with memory heap usage rising to 39% at 10,000 requests.
- Security: The API Gateway successfully mitigated SQL injection, command injection, and XSS attacks after initial vulnerability patches were applied.
Predictive Model Accuracy:
- The models achieved an average accuracy of 87% across all languages and folds.
- Multinomial Naive Bayes showed a slight performance advantage over Logistic Regression and SVM.
- Polygon Area Metric (PAM): Used to evaluate the balance between Precision, Recall, F1-Score, Specificity, and AUC-ROC. Multinomial Naive Bayes yielded the largest polygon area, indicating a superior balance of metrics, while Logistic Regression demonstrated the most uniform performance across axes.
- Error Analysis: Approximately 13% error rate was observed, primarily due to false positives on emphatic capitalization and false negatives on obscure offensive terms.

Significance and Claims

The authors claim that this work provides a scientifically grounded approach to simultaneously addressing data loss prevention and workplace compliance. The significance of the research lies in its demonstration that traditional machine learning models (Logistic Regression, SVM, Naive Bayes) can offer a more sustainable trade-off between predictive power and hardware requirements compared to resource-intensive Transformer-based architectures (like BERT) for real-time corporate monitoring.

The paper emphasizes that the proposed framework is not merely a punitive tool but a mechanism for fostering a safer, more inclusive workplace. By centralizing monitoring and predictive capabilities, the system enables organizations to detect indicators of data exfiltration and policy violations promptly. The authors conclude that the solution is viable for deployment in diverse hardware environments, from legacy workstations to modern enterprise systems, provided that ethical considerations regarding transparency and employee consent are strictly observed. Future work is suggested to focus on large-scale production validation, runtime optimization using native images (e.g., GraalVM), and the integration of differential privacy techniques.