Application Allowed List Generation via Machine Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Maintaining authorized application lists across a large organization's hybrid environment is challenging, leading to vulnerabilities and increased risk of cyber-attacks, as it requires significant computational effort and is difficult to ensure only authorized applications execute on each computer.
Innovation Solution
A computing system that identifies executed applications on machines, clusters them based on similarity, generates allowed lists for each cluster, and distributes these lists to enforce execution of only authorized applications, reducing the need for manual maintenance and improving usability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual maintenance of allowed lists is performed across a large organization's hybrid environment, then security control is maintained, but significant computational effort and time are required, and vulnerabilities increase
Solution Approach 1:
The system automatically generates allowed lists by analyzing executed applications on machines themselves, without requiring external manual intervention. Each machine's security tool collects data about its own application executions, and the system autonomously updates allowed lists based on this self-reported data, eliminating the need for manual maintenance while maintaining security control
Solution Approach 2:
The system performs preliminary analysis of application execution patterns and pre-generates allowed lists before security vulnerabilities can exploit manual maintenance delays. By proactively updating allowed lists based on observed execution patterns, the system maintains security control without waiting for manual intervention
2Reliability
If manual maintenance of allowed lists is performed, then security control is maintained, but the complexity of managing thousands of servers and user computers increases significantly
Solution Approach 1:
The system merges machines into clusters based on similarities in their executed application patterns. By grouping machines with comparable security profiles, the system reduces the number of individual allowed lists that must be managed, thereby reducing overall system complexity while maintaining security control across the hybrid environment
Solution Approach 2:
The system segments the large organization's IT infrastructure into manageable clusters of machines with similar characteristics. This segmentation allows security management to handle groups of machines rather than individual devices, significantly reducing the complexity of managing thousands of servers and user computers while maintaining granular security control
3Productivity
If automated clustering and allowed list generation is implemented, then computational effort and time are reduced, but the complexity of the security system increases
Solution Approach 1:
Security tools installed on each machine automatically collect data about executed applications and report it to the central system. The system then autonomously processes this data, performs clustering analysis, generates allowed lists, and distributes them back to the appropriate machines. This self-service automation dramatically improves productivity while the modular architecture manages system complexity by distributing functions across multiple components
4Ease of operation
If allowed lists are not properly maintained, then maintenance effort is reduced, but vulnerabilities and cyber-attack risks increase
Solution Approach 1:
The system continuously monitors application execution patterns on machines and uses this feedback to dynamically update allowed lists. By implementing a closed-loop feedback mechanism where execution data automatically triggers allowed list updates, the system maintains security against vulnerabilities without requiring manual maintenance effort, as the system self-corrects based on observed patterns
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computing system for generating allowed lists of applications for machines is provided. The system, for each machine, identifies a set of executed applications that were executed by that machine. The system then clusters the machines based on similarity between the sets of executed applications so that machines with similar sets are in the same cluster. The system then, for each cluster of machines, creates an allowed list of applications for the cluster that includes the applications in the sets of executed applications of the machines of the cluster. An allowed list for a cluster indicates that only applications in the allowed list are allowed to be executed by a machine in the cluster. The system then distributes the allowed list for a cluster to the machines of that cluster so that the machines execute only applications in the allowed list for their cluster.