cid bdb0cd7c5daec7072e1c581d6b8b73a405ebf0e80f5ff161ae1f9e3447de48fa · original · open access · via openalex
Title: LUMEN: A Modular, Local-First Architecture for Lightweight Host-Based Threat Detection on Windows Endpoints Authors: Hrishikesh Wadile; Sanaya Kulkarni Pranav Dhote Venue: International Journal of Advanced Research in Science Communication and Technology Year: 2026 Canonical: doi:10.48175/ijarsct-38533 URL: https://doi.org/10.48175/ijarsct-38533 Collector: openalex OA: true ABSTRACT Endpoint threats increasingly evade conventional signature-based tools, while many learning-based alternatives depend on cloud services and heavy resource budgets that are unsuitable for ordinary personal and small-office machines. This paper presents LUMEN, a modular host-based threat detection system for Windows that performs all collection, analysis, storage, and response locally. LUMEN organises endpoint defence into four cooperating layers: telemetry collection, independent detection, risk and alert evaluation, and local storage. Host-level telemetry covering executable and process activity, Windows Event Logs, and browser URL activity is routed through source-specific detectors whose outputs feed a common alert and response layer. The system is implemented in Rust with native Windows interfaces, local ONNX-based inference, SQLite persistence, and a Dioxus desktop interface. This paper focuses on the design rationale, architecture, data flow, and implementation of LUMEN, and demonstrates through functional validation that its components operate together end to end. Quantitative evaluation of the individual detectors and extension to multi-source correlation are outside the scope of this work.