FlagThis

Abstract

Endpoint devices, including laptops, smartphones, and tablets, remain among the most frequently targeted assets in organizational environments and are often implicated in security incidents and data breaches. While commercial Endpoint Detection and Response (EDR) platforms provide extensive monitoring and response capabilities, their deployment costs and operational complexity may limit adoption in small-to-medium enterprises, educational institutions, and other resource-constrained environments. This paper presents SafeGuard, a lightweight, three-tier clientserver architecture, comprising an endpoint agent, a central server, and an administrative dashboard, for real-time endpoint monitoring, threat reporting, and administrative response. Rather than advancing threat-detection algorithms, the contribution of this work lies in the design, implementation, and validation of a lowcost, deployable endpoint security architecture. The endpoint agent is developed with Flutter and extended with Kotlin for Android-level system access; the Node.js-based central server is responsible for authentication and secure message orchestration; and the administrative dashboard provides live endpoint visibility and remote response capabilities, including device locking, application removal, and warning notification dispatch. Threat identification is implemented through signature-based comparison against a maintained threat database, a deliberate design decision intended to minimize computational overhead while preserving practical monitoring functionality. Secure communication is achieved through encrypted WebSocket (WSS) channels, JSON Web Token (JWT)-based authentication, and HMAC message integrity verification. The system was evaluated through unit, integration, and system-level testing, including a simulated 50-endpoint deployment and preliminary security validation against unauthorized access, replay attempts, and SQL injection attacks. Results showed an average command-dispatch latency of approximately 1.5 seconds, remaining below 2 seconds under simulated load. These findings indicate that an open-source technology stack can deliver real-time endpoint visibility and coordinated administrative response without the licensing costs of commercial EDR platforms. Limitations, including reliance on static threat signatures and Android-focused implementation depth, are discussed together with directions for future extension through advanced detection mechanisms and broader platform support.