Access Control System Using Grammar-Based Behavior Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current IT security systems lack fine-grained control over user or program behavior, leading to over-provisioning of access and manual labor in setting application-specific rights, which is inefficient and prone to errors, especially in large enterprises with complex regulatory compliance and threat landscapes.
Innovation Solution
A method that classifies computer statements against a grammar using first-order logic and stochastic logic programs to determine patterns of acceptable behavior, allowing for real-time analysis and efficient determination of new or potentially dangerous behavior, thereby enabling automated security controls without manual setting of rights.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If application-level authorization is used to control access to computer resources, then access control precision is improved, but device complexity and manual labor increase significantly
Solution Approach 1:
The system automatically generates authorization rules by monitoring and analyzing actual access patterns between consumers and resources. Instead of requiring manual configuration, the system self-learns the necessary access controls by observing what consumers actually need to do to perform their functions, thereby reducing manual labor while maintaining precise access control.
Solution Approach 2:
The system implements a feedback loop where access attempts are monitored, analyzed, and used to automatically update authorization rules. The system observes successful and unsuccessful access patterns, learns from this feedback, and automatically adjusts the authorization rules to prevent future unauthorized access while allowing legitimate operations.
2Measurement precision
If manual setting of application-specific rights is performed, then access control precision is improved, but productivity decreases due to laborious configuration
Solution Approach 1:
The system automatically generates authorization rules by monitoring and analyzing actual access patterns between consumers and resources. Instead of requiring manual configuration, the system self-learns the necessary access controls by observing what consumers actually need to do to perform their functions, thereby reducing manual labor while maintaining precise access control.
Solution Approach 2:
The system proactively monitors and analyzes access patterns in advance to automatically generate authorization rules before security incidents occur. By performing preliminary analysis of consumer behavior and resource access patterns, the system prepares authorization rules ahead of time, eliminating the need for reactive manual configuration after security issues arise.
3Ease of operation
If over-provisioning of access rights is implemented, then ease of operation is improved, but security reliability deteriorates
Solution Approach 1:
The system starts by allowing broader access (excessive action) during the monitoring phase to ensure business operations can proceed without interruption. Once the monitoring period completes and authorization rules are generated, the system then applies precise access controls (partial action) that allow only the specific operations actually needed, thereby eliminating unnecessary access rights while maintaining operational flexibility.
Solution Approach 2:
The system dynamically adjusts access rights based on the monitoring phase status. During the monitoring phase, broader access is permitted to capture complete usage patterns. After monitoring completes and rules are generated, the system transitions to enforcing precise, dynamically-generated authorization rules that adapt to actual business needs, thereby improving security without permanently restricting legitimate operations.
4Reliability
If fine-grained access control is implemented, then security reliability is improved, but device complexity increases
Solution Approach 1:
The system uses a universal monitoring and analysis framework that can handle multiple consumers, resources, and access patterns through a single unified mechanism. The same monitoring infrastructure, pattern analysis algorithms, and rule generation processes are applied across all access control scenarios, thereby achieving fine-grained security without proportionally increasing system complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computer message that is being sent from a consumer to a computer resource is checked to determine whether the computer message meets all of a set of one or more specified conditions. If so, the computer message is compared with a baseline, the baseline containing a set of computer messages which have been classified according to whether or not each of the computer messages of the set represents acceptable behaviour in the context of the computer resource. If the comparison with the baseline determines that the computer message represents acceptable behaviour in the context of the computer resource, the computer message is permitted to be passed to the computer resource.