Hybrid Intelligence Endpoint Defense (HIED): A Data-Fusion Approach for Proactive Malware Detection

We present Hybrid Intelligence Endpoint Defense (HIED), which combines Endpoint Detection and Response (EDR) telemetry with Cyber Threat Intelligence (CTI) to improve malware detection using data already available in enterprises. We use Windows 10 Sysmon logs (synthetic and real) and enrich them with AlienVault Open Threat Exchange (OTX) indicators (e.g., domains, IPs, hashes). We evaluate four ways to fuse the two sources: feature-level (early), decision-level (late) with two variants, and a combined scheme, training Random Forest, XGBoost, and Local Outlier Factor. Rather than attaching CTI via post-hoc lookups, we inject CTI at the feature stage and measure early versus late fusion directly. Early fusion performs best, raising the Matthews Correlation Coefficient from 0.94 (EDR-only) to 0.98, increasing recall from 87.58% to 99.60%, and cutting the false-positive rate from 0.09% to 0.02% on a held-out validation set. The gains come from adding external threat context that helps the classifier separate benign activity from ransomware-like behavior, reducing alert fatigue. The study fits ICAIC’2026 Tracks 8 (AI in Cyber Security), 12 (AI in Malware Analysis/Digital Forensics), and 6 (AI in IT Infrastructure) and shows that standard Sysmon logs plus open CTI can go further—no new sensors required. We also note deployment considerations and current limitations, and we outline next steps: real-time fusion, multi-feed CTI, and broader malware coverage.