Application Control Rules via User Competency Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing application control systems face challenges in effectively configuring rules to manage unknown software, often blocking harmless applications due to a lack of classification-based safety measures, leading to inefficiencies in protecting computing devices from malicious threats.
Innovation Solution
A method and system that classify applications into predetermined groups, determine a user's computer competency score, and categorize applications based on their functions, purpose, and criticality scores to define control rules, allowing more nuanced access control for unknown software.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a default denial approach with a whitelist of trusted applications is used, then computer security is improved by blocking malicious software, but harmless unknown applications are incorrectly blocked leading to false positives
Solution Approach 1:
The system changes the parameter of application classification by introducing a competency score parameter that quantifies the trustworthiness of unknown applications. Instead of binary whitelist/blacklist classification, the system assigns numerical scores based on multiple attributes (application behavior, user profile, system state) to dynamically determine whether to allow or block execution, thereby reducing false positives while maintaining security
Solution Approach 2:
The system introduces an intermediary classification mechanism between the whitelist and complete freedom. Unknown applications are not immediately blocked nor allowed, but subjected to intermediate evaluation through competency scoring. This intermediary layer analyzes application characteristics and user context to make informed decisions, preventing both malicious and harmless unknown applications from being treated identically
2Reliability
If application control rules are configured to block all unknown software, then protection against malicious threats is improved, but legitimate unknown applications are prevented from operating
Solution Approach 1:
The system makes the application control rules dynamic rather than static. Instead of fixed whitelist/blacklist rules, the competency score and control rules are continuously adjusted based on real-time analysis of application behavior, user competency changes, and system state. This dynamic adaptation allows legitimate applications to be permitted over time while maintaining protection against threats
Solution Approach 2:
The system segments the application control mechanism into multiple independent components: application classification module, competency scoring module, category assignment module, and rule generation module. Each module handles a specific aspect of the evaluation process, allowing for fine-grained control and more nuanced decision-making compared to monolithic approval/denial systems
3Ease of operation
If a classification-based approach with competency scoring is implemented, then false positives are reduced and unknown safe applications can operate, but the system complexity increases
Solution Approach 1:
The system implements self-service by automatically generating control rules based on competency scores and application categories without requiring manual administrator configuration for each application. The system autonomously evaluates unknown applications, assigns categories, determines competency scores, and configures appropriate control rules, reducing the burden on administrators while maintaining high accuracy
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed is a system and a method for configuring control rules for applications executable on a computer. An example method includes classifying computer applications into one of a plurality of classification groups that include at least one predetermined classification group and an unknown classification group (201). The method further includes configuring control rules when the applications are classified in the unknown classification group (202) that is done by determining, by the hardware processor, a computer competency score for a user of the computer (206); categorizing the applications into one or more predefined categories (204), and defining control rules for the application based on the determined computer competency score for the user and the one or more predefined categories of the at least one application (207).