Endpoint Security Module for Automated Application and Network Allow-Lists
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The manual setting of application behavior and network communication allow-lists in large data centers is burdensome and prone to errors, necessitating an automated and dynamic solution for establishing and updating allow-lists to prevent malicious programs and illegal access.
Innovation Solution
A security managing module that captures and analyzes program and communication features to automatically establish candidate rules, filters them based on a confidence region, and applies allow-lists for security control, using computational models like deep learning to dynamically update these lists.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual setting of allow-lists is used, then security control can be implemented, but the workload and time consumption increase significantly when the data center has a great number of server hosts
Solution Approach 1:
The system automatically generates allow-lists by capturing and analyzing program features and communication features of application programs without requiring manual administrator intervention. The security managing module performs self-service by autonomously establishing security rules based on observed program behaviors and communication patterns.
Solution Approach 2:
The system continuously monitors and captures program features and communication features, analyzes this feedback information, and dynamically updates the allow-list accordingly. This closed-loop feedback mechanism enables the system to adapt to changing security requirements automatically.
2Reliability
If manual setting of allow-lists is used, then security control can be implemented, but the complexity and error-proneness increase when the data center has a great number of server hosts
Solution Approach 1:
The security managing module autonomously performs feature capture, analysis, and rule generation without requiring manual configuration. This self-service approach reduces the complexity of manual management and minimizes human errors in configuring security policies for numerous server hosts.
Solution Approach 2:
The system replaces the mechanical manual process of administrators configuring allow-lists with an automated computational system that uses feature analysis and confidence region calculations to generate security rules programmatically.
3Productivity
If automated feature analysis and rule generation is implemented, then manual workload is reduced, but computational resources are consumed
Solution Approach 1:
The system filters data packets based on communication operations before performing detailed feature analysis, analyzing only the necessary subset of data. This partial action approach reduces computational overhead while maintaining effective security monitoring and allow-list generation.
Data Source
AI summary
A security managing module, includes the following elements. A capturing unit, for capturing a plurality of first program features of an application program, and capturing a plurality of first communication features of a data packet. An analyzing unit, for analyzing the first program features to generate a plurality of second program features, filtering the data packet according to a communication operation of the data packet, and analyzing the first communication features of the data packet which is filtered to generate a plurality of second communication features. A rule establishing unit, for establishing a candidate rule according to the first program features and the first communication features. A rule filtering unit, for filtering the candidate rule to generate an allow-list according to a confidence region. A security control unit, for executing a security control according to the allow-list.