Machine-Learning Application Clustering for Runtime-Aware Security Policies

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Maintaining the security of computer software applications running on computer networks is challenging due to the increasing number of applications deployed, which overwhelms security operations teams and relies heavily on manual, error-prone efforts that do not consider runtime behavior.

Innovation Solution

A system and method using machine learning algorithms to cluster applications based on their included libraries and observed events, automatically suggesting security policies by analyzing their software composition and runtime behavior, thereby improving the security posture of applications.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If manual security policy creation is used for each application, then security coverage is achieved, but security operations teams are overwhelmed and productivity decreases

Engineering Contradiction:

Improvesecurity coverageVSAvoidsecurity operations efficiency

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The system enables security policies to be automatically generated and applied without manual intervention. The clustering algorithm autonomously analyzes application features, groups similar applications, and recommends security policies, allowing the security system to serve itself rather than requiring continuous human effort for each application.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

Security policies are copied from representative applications within each cluster to other applications in the same cluster. Instead of creating unique policies for every application, the system creates one policy per cluster and replicates it across all member applications, dramatically improving productivity while maintaining consistent security coverage.

Inventive Principle:

Principle #26Copying

2Reliability

If traditional security monitoring is used, then security events are detected, but runtime behavior is not considered and measurement precision is insufficient

Engineering Contradiction:

Improvesecurity event detectionVSAvoidruntime behavior analysis accuracy

Core Design Contradiction:

ReliabilityVSMeasurement precision

Solution Approach 1:

The system performs preliminary analysis of application runtime behavior by collecting and analyzing event data before finalizing security policy recommendations. This preliminary action includes monitoring application executions, capturing runtime events, and using this behavioral data to refine cluster assignments and policy suggestions, thereby improving measurement precision without sacrificing detection reliability.

Inventive Principle:

Principle #10Preliminary action

3Reliability

If security policies are created for every individual application, then comprehensive security is achieved, but device complexity and manual effort increase significantly

Engineering Contradiction:

Improvecomprehensive security coverageVSAvoidsecurity policy management complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system segments the application portfolio into distinct clusters based on shared characteristics such as technology stack, runtime behavior, and event patterns. This segmentation transforms the monolithic task of securing every individual application into manageable cluster-level policies, reducing complexity while maintaining comprehensive coverage through targeted security measures for each segment.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Security policies are designed to be universal within each cluster, serving multiple applications simultaneously. A single security policy can be applied to all applications in a cluster, making the policy multi-functional rather than single-purpose. This universality reduces the total number of policies needed and simplifies management while still providing appropriate security for each application type.

Inventive Principle:

Principle #6Universality (Multi-functionality)

4Reliability

If manual security operations are used, then security policies can be applied, but the process is error-prone and time-consuming

Engineering Contradiction:

Improvesecurity policy applicationVSAvoidsecurity operations time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system implements feedback loops where security policy effectiveness is continuously monitored and evaluated. Runtime behavior data and security events provide feedback that refines cluster assignments and policy recommendations over time. This automated feedback mechanism reduces manual review time, minimizes errors by catching issues automatically, and continuously improves policy accuracy without adding time overhead.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS12418568B2Systems and methods for application clustering based on included libraries and observed events

Publication Date: 2025.09.16 CISCO TECHNOLOGY INC

AI summary

A system of one embodiment that provides proactive security policy suggestions for applications based on the applications' software composition and runtime behavior. The system includes a memory and a processor. The system is operable to access data that represents one or more features of an application. The application is running on one or more nodes in a computer network, and a feature indicates an application library of the node. The system is operable to apply a clustering algorithm to the data to generate a plurality of cluster sets. The system is operable to determine a security policy to apply to a cluster set of the plurality of cluster sets and apply the security policy to an application whose features are represented by the data in the cluster set.