Process-Connection Wildcarding for Automated Whitelist Population
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Manual population of whitelists for complex applications with distributed components is burdensome, as different whitelists are required for each host, and existing automated approaches are inadequate in reducing false-negative and false-positive alerts.
Innovation Solution
The use of process-connection wildcarding, including process-argument wildcarding and connection abstraction, to auto-populate whitelists by grouping processes and connections, allowing for wildcarding of unobserved instances and reducing the need for manual updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual population of whitelists is performed for each host in distributed systems, then security coverage is complete, but the workload and time consumption increase significantly
Solution Approach 1:
The patent merges the whitelist population process across multiple hosts by using a centralized learning mode that collects process-connection data from all hosts, then generates a unified whitelist that applies system-wide. This eliminates the need to manually populate separate whitelists for each host while maintaining comprehensive security coverage.
Solution Approach 2:
The system implements self-service by automatically learning and populating whitelists through monitoring process-connection requests during a learning mode. The whitelist generation is performed autonomously without manual intervention, and the system continuously updates whitelists based on observed legitimate connections, reducing both time consumption and human workload.
2Ease of manufacture
If automated whitelist population is implemented, then manual workload is reduced, but false-negative and false-positive alerts increase
Solution Approach 1:
The system performs preliminary action by implementing a learning mode before production mode, where it observes and collects process-connection data to establish a baseline of legitimate behavior. This preliminary learning phase enables the automated whitelist population to be more accurate by understanding normal system operations before making security decisions, thereby reducing false alerts.
Solution Approach 2:
The patent applies parameter changes by using wildcarding techniques that generalize specific process-connection patterns into broader rules. Instead of creating exact matches for every observed connection, the system transforms specific parameters into wildcard patterns that cover variations of legitimate connections, improving alert accuracy while maintaining automation.
3Measurement precision
If specific process-connection rules are created for each observed connection, then security precision is high, but the complexity and number of whitelist entries increase
Solution Approach 1:
The system transforms specific process-connection parameters into wildcard patterns, changing the representation from exact matches to generalized rules. This parameter transformation reduces whitelist complexity by consolidating multiple specific rules into fewer wildcarded rules that cover the same security requirements with higher-level abstractions.
Solution Approach 2:
The patent applies universality by creating wildcarded whitelist entries that serve multiple functions simultaneously. A single wildcarded rule can cover multiple process-connection variations that would otherwise require separate specific rules, making the whitelist more universal and less complex while maintaining the same security precision.
Data Source
AI summary
A computer security system provides for auto-populating process-connection whitelists using process wildcarding and connection wildcarding. Process wildcarding involves grouping process-connection requests together in a process* group without regard to the presence of distinct process arguments; in contrast, some process-connection requests may be separated both by process and by argument into processâ—Źargument groups. The process-connection requests may then be analyzed on a group-by-group basis to determine which processes can be mapped to wildcarded connection in a respective process-connection whitelist.