Application Control Rule Conflict Resolution via Automated Testing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern application control systems face conflicts between new and existing application control rules, leading to incorrect verdicts and administrative challenges in managing software execution permissions across a corporate network, due to applications being categorized inconsistently and administrators struggling to maintain accurate control policies.
Innovation Solution
A system that generates, tests, and reconfigures application control rules by collecting information about software applications and users, categorizing them based on developer, function, and metadata, and comparing verdicts to identify and resolve conflicts between new and existing rules, using a priority scheme to eliminate conflicts and add exceptions as necessary.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If application control rules are created based on categorization and inventory techniques to satisfy security policy, then flexibility and diversification of application control is improved, but conflicts between new and existing rules occur leading to incorrect verdicts
Solution Approach 1:
The system performs preliminary testing of new application control rules against existing rules before deployment. The testing module simulates verdicts for both new and existing rules using collected application information, identifying conflicts in advance before they affect actual application control operations.
Solution Approach 2:
The system implements a feedback mechanism where testing results are fed back to the configuration process. When conflicts are detected between new and existing rules, the system notifies administrators and allows modification of the new rules based on the feedback, ensuring reliability before deployment.
2Adaptability or versatility
If administrators manually manage and fine-tune control rules depending on user needs and security policy, then customization for different users is improved, but administrative time and complexity increase
Solution Approach 1:
The system enables self-service through automated rule testing and conflict detection. The testing module automatically evaluates new rules against the existing rule set using collected application data, reducing the need for manual administrative intervention and fine-tuning while maintaining customization capabilities.
Solution Approach 2:
The system replaces manual mechanical administrative work with automated computational processes. The testing module uses algorithmic comparison of verdicts between new and existing rules, substituting human administrative effort with automated conflict detection and notification mechanisms.
3Adaptability or versatility
If multiple categorization criteria are used to assign applications to categories, then diversified control options are improved, but applications may trigger different rules causing conflicts
Solution Approach 1:
The system extracts the complexity of rule conflict detection into a separate testing module. This module specifically handles the analysis of multiple categorization criteria and their interaction with control rules, isolating the complexity from the main rule management process and presenting simplified results to administrators.
Data Source
Figure 1
Figure 2
Figure 3A~3B
AI summary
Disclosed are systems, methods and computer program products for configuring application control rules. The system creates a new application control rule that specifies restrictions or permission on execution a software application, a function of an application or a category of applications. The system then collects information about one or more computers in a network, including information about software applications deployed on the computers and existing application control rules. The system then tests the new application control rule using the collected information to determine verdicts rendered by the new application control rule that restrict or permit execution of an application, certain function of an application or a category of applications. The system then compares verdicts rendered by the new application rule with the verdicts rendered by the existing application control rules to identify conflicting rules, and reconfigures the new application control rule to eliminate conflicts.