System and method for generating application control rules

Patent metadata

Field	Value
Publication number	US-10019587-B2
Application number	US-201514701636-A
Country	US
Kind code	B2
Filing date	May 1, 2015
Priority date	Feb 20, 2015
Publication date	Jul 10, 2018
Grant date	Jul 10, 2018

Abstract

Disclosed is a system and method for configuring control rules for applications executable on a computer. An example method includes classifying computer applications into one of a plurality of classification groups that include at least one predetermined classification group and an unknown classification group. The method further includes configuring control rules when the applications are classified in the unknown classification group that is done by determining, by the hardware processor, a computer competency score for a user of the computer; categorizing the applications into one or more predefined categories, and defining control rules for the application based on the determined computer competency score for the user and the one or more predefined categories of the at least one application.

First claim

The invention claimed is:

1. A method for configuring control rules for applications executable on a computer, the method comprising:
classifying, by the hardware processor, at least one computer application into one of a plurality of classification groups that include a trusted classification group, a malicious classification group, and an unknown classification group;
configuring, by the hardware processor, at least one control rule when the at least one application is classified in the unknown classification group by:
determining, a computer competency score for a user of the computer, wherein the computer competency score comprises a numerical evaluation indicating a level of computer competence of the user;
categorizing, based on system library application programming interface (API) functions used by the at least one application, the at least one application into a plurality of categories, wherein at least one category indicates an access capability of the at least one application;
calculating, a criticality score of the at least one application as a sum of the criticality scores of the categories in which of the at least one application appears divided by a sum of criticality scores of all predefined categories and multiplied by a correction factor; and
generating the at least one control rule for the at least one application that denies use of the application based on a comparison of the determined computer competency score for the user and the calculated criticality score of the at least one application; and
blocking execution of the at least one application based on the generated control rule.

2. The method of claim 1 , wherein the user information includes one or more of a security access level of the user, a social network profile information of the user, and a personal information of the user.

3. The method of claim 2 , wherein the social network profile information of the user and/or the personal information of the user includes at least one of j ob position, company name, and field of work of the user.

4. The method of claim 1 , wherein the determining of the computer competency score of the user is further based on the computer information comprising at least one of computer security event log, network resources access log, and the one or more predefined categories of the at least one application.

5. The method of claim 1 , wherein the criticality score of a second application is calculated as a power series according to:
C=Σa i C i b i ,

wherein C is the criticality score, a i is a weight of i-th category, C i is a criticality score of i-th category, and b i is a power coefficient for i-th category.

6. A system for configuring control rules for applications executable on a computer, the system comprising:
a hardware processor configured to:
classify at least one computer application into one of a plurality of classification groups that include a trusted classification group, a malicious classification group, and an unknown classification group;
configure at least one control rule when the at least one application is classified in the unknown classification group by:
determining a computer competency score for a user of the computer, wherein the computer competency score comprises a numerical evaluation indicating a level of computer competence of the user;
categorizing, based on system library application programming interface (API) functions used by the at least one application, the at least one application into a plurality of categories, wherein at least one category indicates an access capability of the at least one application;
calculating a criticality score of the at least one application as a sum of the criticality scores of the categories in which of the at least one application appears divided by a sum of criticality scores of all predefined categories and multiplied by a correction factor; and
generating the at least one control rule for the at least one application that denies use of the application based on a comparison of the determined computer competency score for the user and the calculated criticality score of the at least one application; and
block execution of the at least one application based on the generated control rule.

7. The system of claim 6 , wherein the user information includes one or more of a security access level of the user, a social network profile information of the user, and a personal information of the user.

8. The system of claim 7 , wherein the social network profile information of the user and/or the personal information of the user includes at least one of job position, company name, and field of work of the user.

9. The system of claim 6 , wherein the determining of the computer competency score of the user is further based on computer information comprising at least one of computer security event log, network resources access log, and the one or more predefined categories of the at least one application.

10. The system of claim 1 , wherein the criticality score of a second application is calculated as a power series according to:
C=Σa i C i b i ,

wherein C is the criticality score, a i is a weight of i-th category, C i is a criticality score of i-th category, and b i is a power coefficient for i-th category.

11. A non-transitory computer readable medium storing computer executable instructions for configuring control rules for applications executable on a computer, including instructions for:
classifying, by the hardware processor, at least one computer application into one of a plurality of classification groups that include a trusted classification group, a malicious classification group, and an unknown classification group;
configuring, the hardware processor, at least one control rule when the at least one application is classified in the unknown classification group by:
wherein the configuring of the at least one control rule includes:
determining, by the hardware processor, a computer competency score for a user of the computer, wherein the computer competency score comprises a numerical evaluation indicating a level of computer competence of the user;
categorizing, based on system library application programming interface (API) functions used by the at least one application, the at least one application into a plurality of categories, wherein at least one a first category indicating indicates an access capability of the at least one application;
categorizing, based on a match of at least a portion of a name of the application, the at least one application into a second category indicating a purpose of the at least one application;
calculating, by the hardware processor, a criticality score of the at least one application based on as a sum of the criticality scores of the categories in which of the at least one application appears and corresponding weights of the categories divided by a sum of criticality scores of all predefined categories and multiplied by a correction factor; and
generating the at least one control rule for the at least one application that denies use of the application based on a comparison of the determined computer competency score for the user and the calculated criticality score of the at least one application; and
blocking execution of the at least one application based on the generated control rule.

12. The medium of claim 11 , wherein the criticality score of a second application is calculated as a power series according to:
C=Σa i C i b i ,

wherein C is the criticality score, a i is a weight of i-th category, C i is a criticality score of i-th category, and b i is a power coefficient for i-th category.

Assignees

• Kaspersky Lab Zao
• AO Kaspersky Lab

Inventors

• Ladikov Andrey V

Classifications

• G06F21/604 Primary

  Tools and structures for managing or administering access control systems · CPC title

• G06F17/30598

  Physics · mapped topic