Systems and methods for application clustering based on included libraries and observed events
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Maintaining the security of computer software applications running on computer networks is challenging due to the increasing number of applications deployed, which overwhelms security operations teams and relies heavily on manual, error-prone methods that do not consider runtime behavior.
Innovation Solution
A system and method using machine learning algorithms to cluster applications based on their included libraries and observed events, automatically suggesting security policies by analyzing software composition and runtime behavior, thereby improving scalability and accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual methods are used to maintain security of applications, then security policies can be applied to individual applications, but the process is error-prone and does not consider runtime behavior
Solution Approach 1:
The system enables security policies to be automatically generated and applied based on runtime behavior observation and library analysis, allowing the security system to serve itself without constant human intervention. The automated clustering and policy generation mechanisms reduce manual effort while improving consistency and accuracy of security policy application.
Solution Approach 2:
The patent replaces manual security analysis and policy creation (mechanical human processes) with automated computational systems that observe runtime behavior, analyze libraries, and generate policies algorithmically. This substitution eliminates human error and enables systematic consideration of runtime behavior that was previously impossible.
2Productivity
If the number of deployed applications increases, then more applications can be run on the network, but security operations teams are overwhelmed
Solution Approach 1:
The system merges multiple applications into clusters based on their runtime behavior and library similarities. By grouping applications with comparable security characteristics, the system reduces the number of individual policy decisions needed, making security operations manageable even as application deployment capacity increases.
Solution Approach 2:
The patent creates universal security policies that can be applied to clusters of applications sharing common characteristics. A single policy can protect multiple applications within a cluster, allowing the security system to scale efficiently without requiring proportional increases in security operations resources.
3Reliability
If traditional security methods are used, then existing applications can be protected, but new applications and tiers cannot be quickly secured
Solution Approach 1:
The system performs preliminary analysis of application libraries and runtime behavior to pre-determine appropriate security policies. By observing and clustering applications during runtime, the system prepares security policies in advance, enabling rapid deployment when new applications or tiers are introduced without lengthy security assessment delays.
Data Source
AI summary
A system of one embodiment that provides proactive security policy suggestions for applications based on the applications' software composition and runtime behavior. The system includes a memory and a processor. The system is operable to access data that represents one or more features of an application. The application is running on one or more nodes in a computer network, and a feature indicates an application library of the node. The system is operable to apply a clustering algorithm to the data to generate a plurality of cluster sets. The system is operable to determine a security policy to apply to a cluster set of the plurality of cluster sets and apply the security policy to an application whose features are represented by the data in the cluster set.