Transfer Learning Platform for Mobile Enterprise Security Policy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mobile enterprise security systems face challenges in efficiently transferring and applying security policies across different enterprises, particularly due to differences in risk attributes and minimal annotation data, leading to false positives and negatives in risk management.
Innovation Solution
A transfer learning platform system (TLPS) that introduces an enterprise security policy (IESP) to toggle on and off, capturing system log changes to determine relevant policies, using neural embeddings and matrix factorization to identify similar enterprises and apply policies only where they are effective, thereby reducing unnecessary rule configurations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security policies are transferred across different enterprises, then security coverage is improved, but false positives and negatives increase due to differences in risk attributes
Solution Approach 1:
The system changes the parameters of policy transfer by introducing a toggle mechanism that activates only during threat conditions, and by modifying the evaluation parameters to compare log changes rather than absolute log states. This allows policies to be adapted to different enterprise contexts by observing actual behavioral changes during security events.
Solution Approach 2:
The system implements feedback by capturing log elements before and after policy application, comparing the differences to determine actual policy effectiveness. This feedback loop allows the system to learn which policies work in specific enterprise contexts and adjust future policy transfers accordingly, reducing false positives and negatives.
2Adaptability or versatility
If security policies are applied to all enterprises, then comprehensive coverage is achieved, but resource efficiency decreases due to unnecessary rule configurations
Solution Approach 1:
The system applies local quality by determining policy applicability to specific enterprises based on their unique risk attributes and operational contexts. Rather than uniformly applying all policies, the system identifies which policies are relevant for each enterprise by analyzing their specific log change patterns, thereby avoiding unnecessary resource consumption on irrelevant rules.
Solution Approach 2:
The system uses partial action by applying security policies selectively only to enterprises where they are likely to be effective, rather than attempting comprehensive coverage. The toggle mechanism ensures policies are activated only when needed (during threats), and the log comparison process filters out excessive or inappropriate policies for specific enterprises.
3Speed
If security policies are toggled on during threats, then responsive security coverage is improved, but system complexity increases due to logging and comparison operations
Solution Approach 1:
The system performs preliminary action by capturing and storing log elements before policy application, so that when a threat occurs and the policy is toggled on, the system can immediately compare the pre-captured logs with new logs to assess policy effectiveness. This pre-preparation reduces the computational burden during actual threat response.
Solution Approach 2:
The system extracts only the relevant information by focusing comparisons on log changes rather than processing entire log datasets. By isolating and comparing only the differential log elements (changes between states), the system reduces processing complexity while maintaining responsive security coverage during threats.
Data Source
AI summary
A computer implemented system and method provide for a transfer learning platform system. The method provides an introduced enterprise security policy (IESP) to a first enterprise system. During a threat, the IESP is toggled on and off. A first change element is determined that represents a change in a logging system of the first enterprise between a first and second log element of the first enterprise captured when the IESP was toggled on and off, respectively. The IESP is provided to a second enterprise system. A second change element is determined that represents a change in a logging system of the second enterprise between a first log element of the second enterprise. The method further determines that the first and second change element are different, and, conditioned upon the determining that the second change element is different than the first change element, removes the IESP from the second enterprise system.