Context-Specific Allowlists with Confidence Ratings for RASP
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing runtime application self-protection (RASP) technologies face challenges in achieving negligible runtime overhead and preventing attacks without interfering with legitimate application execution, while allowlists are application-specific and require evolution with the code they protect, leading to usability issues and false positives.
Innovation Solution
Implementing context-specific allowlists with confidence ratings, where operations are partitioned by context, metrics are calculated, and allowlists are updated based on thresholds, ensuring granular security policies and reducing false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If allowlists are made application-specific to improve security robustness, then security effectiveness is improved, but usability and maintenance complexity worsen
Solution Approach 1:
The patent segments the monolithic allowlist into multiple context-specific allowlists, where each allowlist is tailored to a particular application context. This segmentation enables granular security control for different contexts while maintaining a unified management framework, thus improving security effectiveness without completely sacrificing usability through automated context identification and management.
Solution Approach 2:
The patent changes the parameter of allowlist specificity from a single static allowlist to multiple dynamic context-specific allowlists. Each allowlist is generated with parameters optimized for its specific context, and the system dynamically selects the appropriate allowlist based on the current execution context, thereby improving security while managing complexity through parameterization.
2Adaptability or versatility
If allowlists are updated frequently to adapt to code changes, then security adaptability is improved, but false positives increase
Solution Approach 1:
The patent performs preliminary actions by generating context-specific allowlists in advance through static analysis of the application code. These allowlists are prepared before runtime, capturing the legitimate behavior patterns of each context. During runtime, the system simply matches execution against the pre-generated allowlists, avoiding the need for frequent updates and reducing false positives caused by dynamic code changes.
Solution Approach 2:
The patent implements a feedback mechanism where the system monitors execution patterns and uses this feedback to refine and update context-specific allowlists. The feedback loop analyzes actual runtime behavior against the allowlists and adjusts them accordingly, improving adaptability while maintaining reliability by base on empirical data rather than frequent speculative updates.
3Measurement precision
If context-specific allowlists are implemented to reduce false positives, then measurement precision is improved, but device complexity increases
Solution Approach 1:
The patent segments the security monitoring system into multiple context-specific allowlists, each tailored to detect legitimate behavior in specific application contexts. This segmentation improves measurement precision by reducing false positives through context-aware detection. The system manages the complexity of multiple allowlists through automated generation and dynamic selection based on execution context.
Solution Approach 2:
The patent implements self-service mechanisms where the system automatically generates, updates, and manages context-specific allowlists without requiring manual intervention. The system autonomously analyzes application code, identifies execution contexts, and creates appropriate allowlists, thereby improving detection accuracy while minimizing the operational complexity burden on users.
Data Source
AI summary
Autonomous learning of context-specific allowlists with confidences includes performing operations. The operations include obtaining a first batch of observations of an operation in a context and partitioning the first batch of observations by the context to obtain subsets of observations. The operations further include, for each subset of a plurality of subsets of observations to obtain metrics and confidence ratings, selecting, according to the context, a context-specific allowlist from multiple context-specific allowlists, comparing the operation in each observation in the subset to the context-specific allowlist to obtain a metric regarding the subset, calculating a confidence rating for the metric from the subset, and updating the context-specific allowlist for the first batch of observations. The operations further include deploying the plurality of context-specific allowlists when the metrics and the confidences satisfy a threshold.