Security Rule Recommendation Console Using Process Path Tree Traversal
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Manual writing of security rules for multiple users is time-consuming and difficult due to user-specific application differences, making it inefficient for security companies supporting thousands of users with varying software applications.
Innovation Solution
A recommendation console that collects process paths from user applications, builds a tree data structure from a pool of security rules, and recommends relevant rules by traversing the tree structure to eliminate overlap, thereby automating the rule generation process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual writing of security rules is performed for each user, then rule accuracy and relevance can be ensured, but the time and effort required increases significantly
Solution Approach 1:
The patent creates template security rules that can be copied and automatically instantiated for multiple users. Instead of manually writing unique rules for each user, the system generates templates from process paths and then automatically applies them across user groups, significantly reducing the time and effort required while maintaining rule accuracy through the structured template approach.
Solution Approach 2:
The system changes parameters by automatically generating security rules based on collected process paths and user characteristics. By using algorithms to transform process path data into rule parameters, the system maintains high rule accuracy while eliminating manual writing time. The parameters of rule generation are automated through computer-implemented processes that adapt to different user contexts.
2Adaptability or versatility
If security rules are customized for each user based on their applications, then rule relevance improves, but the complexity of rule management increases
Solution Approach 1:
The patent segments security rules into templates and instances, and further segments users into groups based on common characteristics. By dividing the rule management system into hierarchical levels (templates → user groups → individual users), the system achieves high rule relevance for each user while reducing overall management complexity through centralized template control.
Solution Approach 2:
The system creates universal security rule templates that can serve multiple user groups with similar application profiles. A single template can be instantiated for numerous users, making the rule management system universally applicable across different user contexts without requiring separate manual rules for each user, thus reducing complexity while maintaining relevance.
3Adaptability or versatility
If a large number of security rules are written to cover all possible user scenarios, then comprehensive coverage is achieved, but the time required to write and maintain rules increases
Solution Approach 1:
The patent implements a dynamic rule generation system that automatically creates and updates security rules based on collected process paths and changing user environments. Instead of statically writing all possible rules in advance, the system dynamically generates rules as needed, adapting to new scenarios automatically. This maintains comprehensive scenario coverage while dramatically improving rule generation efficiency through automation.
Solution Approach 2:
The system enables self-service rule generation by automatically collecting process paths, analyzing user characteristics, and generating appropriate security rules without manual intervention. The automated system serves itself by using its own collected data to generate rules, eliminating the need for manual rule writing while achieving comprehensive scenario coverage across all user contexts.
Data Source
AI summary
A method of generating relevant security rules for a user includes the steps of: building a first tree data structure from paths within a pool of security rules; collecting process paths for the user; and compiling the relevant security rules for the user by traversing the first tree data structure according to the process paths of the user.