Application Whitelist Rule Generation from Network and System Logs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing application white list systems require manual rule formulation by professionals, which can be incomplete or outdated, leading to security vulnerabilities, and lack integration between network and application white list rules, resulting in inefficient and insecure rule settings.
Innovation Solution
A method and system that automatically generates application white list rules by analyzing network and system logs to extract application attributes, using a training procedure to create candidate rules, and applying a confidence interval to validate and store rules, integrating internet and application rules for enhanced security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual rule formulation by professionals is used, then rule customization is possible, but rules become incomplete or outdated leading to security vulnerabilities
Solution Approach 1:
The system performs self-service by automatically generating white list rules through analyzing system logs and application behaviors. The computing device autonomously collects log data, extracts application attributes, generates candidate rules, and validates them without requiring continuous manual intervention from security professionals, thereby maintaining security reliability while reducing maintenance time loss
Solution Approach 2:
The system implements feedback mechanisms by continuously monitoring system logs and network behaviors to validate and update white list rules. The confidence interval calculation provides feedback on rule quality, and the system automatically adjusts rules based on observed application behaviors, ensuring rules remain current and secure without manual intervention
2Device complexity
If separate rule settings for network and application white lists are used, then rule management is simple, but integration between network and application rules is lacking
Solution Approach 1:
The system merges network white list and application white list rule generation into a unified process. By simultaneously analyzing network logs and system logs together, the system generates integrated rules that correlate both network and application behaviors, eliminating the need for separate rule settings while improving rule integration capability
Solution Approach 2:
The computing device performs multiple functions through a single unified rule generation system. It simultaneously generates network white list rules, application white list rules, and correlated rules that integrate both types, making the system versatile and adaptable without increasing management complexity
3Measurement precision
If detailed application attributes are extracted from logs, then rule precision is improved, but analysis complexity increases
Solution Approach 1:
The log analysis process is segmented into distinct automated stages: collecting log data, extracting application attributes, generating candidate rules, and validating rules with confidence intervals. This segmentation reduces analysis complexity by breaking down the complex task into manageable automated steps while maintaining high precision in attribute extraction
Data Source
AI summary
A method for generating an application white list is applicable to a server. The method is performed by a computing device communicably connected to the server and includes following steps: collecting a network log and a system log of the server, performing an analysis procedure to extract a plurality of application attributes from the network log and the system log with one of the application attributes being an application identifier, performing a training procedure according to the plurality of application attributes to generate a candidate rule, according to a plurality of behaviors in the network log and the system log, calculating the ratio of the number of behaviors among said plurality of behaviors that conforming to the candidate rule to a number of all of said plurality of behaviors, and storing the candidate rule to a whitelist when the ratio falls within a trust interval.