Advanced rule analyzer to identify similarities in security rules, deduplicate rules, and generate new rules

Patent metadata

Field	Value
Publication number	US-11036867-B2
Application number	US-201916287407-A
Country	US
Kind code	B2
Filing date	Feb 27, 2019
Priority date	Feb 27, 2019
Publication date	Jun 15, 2021
Grant date	Jun 15, 2021

Abstract

Mechanisms for performing advanced rule analysis are provided. The mechanisms perform natural language processing of a security rule set data structure, specifying a plurality of security rules. The mechanisms execute, for each security rule pairing, a determination of a similarity measure indicating a degree of similarity of the textual description of the first security rule in the pairing with the textual description of the second security rule in the pairing, and in response to the security measure being equal to or above duplicate rule threshold value, eliminating one of the first security rule or the second security rule in the pairing from the security rule set data structure to generate a modified security rule set data structure. The mechanisms deploy the modified security rule set data structure to a computing environment for use in identifying security incidents and performing event management.

First claim

What is claimed is:

1. A method, in a data processing system comprising at least one processor and at least one memory, wherein the at least one memory comprises instructions which are executed by the at least one processor and specifically configure the at least one processor to implement an advanced rule analyzer, the method comprising:
performing, by the advanced rule analyzer executing in the data processing system, natural language processing of a security rule set data structure, specifying a plurality of security rules, to identify textual descriptions of tests performed by each of the security rules in the security rule set data structure;
executing, by the advanced rule analyzer, for each security rule pairing comprising a pairing of a first security rule in a plurality of security rules with a second security rule in the plurality of security rules, a determination of a similarity measure indicating a degree of similarity of the textual description of the first security rule in the pairing with the textual description of the second security rule in the pairing, and in response to the security measure being equal to or above duplicate rule threshold value, eliminating one of the first security rule or the second security rule in the pairing from the security rule set data structure to generate a modified security rule set data structure;
deploying, by the advanced rule analyzer, the modified security rule set data structure to a computing environment for use in identifying security incidents and performing event management;
generating, by the advanced rule analyzer, a rule similarity visualization output comprising, for each security rule pairing, a correlation between the first security rule and the second security rule in the security rule pairing and a visual indicator of a degree of similarity between the first security rule and the second security rule in the security rule pairing; and
outputting, by the advanced rule analyzer, the rule similarity visualization output to an authorized computing device for output to an authorized person associated with the computing environment, wherein the rule similarity visualization output comprises, for a selected security rule, a listing of one or more other security rules that have a similarity measure equal to or above a predetermined threshold similarity measure, wherein each entry in the listing comprises, for the corresponding other security rule, one or more characteristics of the corresponding other security rule comprising at least one of a rule identifier, rule name, tests performed by the corresponding other security rule, and a similarity measure for a security rule pair comprising the selected security rule and the other security rule.

2. The method of claim 1 , wherein performing natural language processing on the security rule set data structure further comprises:
performing, for each security rule in the security rule set data structure, a statistical analysis of occurrences of terms in a test portion of the security rule to generate a vector representation of the security rule, wherein the vector representation comprises a plurality of vector values, each vector value being associated with a corresponding term in a recognized vocabulary, and wherein each vector value is set to a value corresponding to a statistical significance of a corresponding term based on results of the statistical analysis.

3. The method of claim 1 , further comprising, for each security rule pairing:
performing, by the advanced rule analyzer, merge analysis on the similarity measure associated with the security rule pairing to determine if the similarity measure of the security rule pairing is equal to or greater than a merge threshold value; and
in response to the similarity measure associated with the security rule pairing being equal to or greater than the merge threshold value, performing, by the advanced rule analyzer, security rule merging to replace the first security rule and the second security rule in the security rule pairing with a replacement security rule comprising elements of both the first security rule and the second security rule.

4. The method of claim 1 , wherein the rule similarity visualization output comprises a heat map visualization in which visual characteristics of regions of the heat map visualization corresponding to security rule pairs represent degrees of similarity between the first security rule and the second security rule of the security rule pair.

5. The method of claim 1 , wherein, for each entry in the listing, differences between characteristics of the selected security rule and the corresponding other security rule are highlighted in the rules similarity visualization output.

6. The method of claim 1 , further comprising:
performing, by the advanced rule analyzer, topic modeling of a standards organization framework definition for security rules to identify at least one of categories or topics of the framework;
determining, by the advanced rule analyzer, for each security rule in the plurality of security rules of the security rule set data structure, an alignment of the security rule with the at least one of categories or topics of the framework based on a similarity analysis of results of natural language processing of the security rule and results of the topic modeling; and
outputting, by the advanced rule analyzer, a notification of the alignment of the security rule set data structure with the at least one of categories or topics of the framework, to an authorized computing device for output to an authorized person associated with the computing environment.

7. The method of claim 1 , further comprising:
performing, by the advanced rule analyzer, natural language processing of standard security rules stored in a standard security rules repository to identify terms present in the standard security rules;
determining, by the advanced rule analyzer, for each security rule in the plurality of security rules of the security rule set data structure, an alignment of the security rule with the standard security rules repository based on a similarity analysis of results of natural language processing of the security rule and results of the natural language processing of the standard security rules; and
outputting, by the advanced rule analyzer, a notification of the alignment of the security rule set data structure with the standard security rules repository, to an authorized computing device for output to an authorized person associated with the computing environment, wherein the notification identifies one or more standard security rules in the standard security rules repository that do not have a corresponding security rule in the security rule set data structure.

8. The method of claim 7 , further comprising:
automatically adding, by the advanced rule analyzer, the one or more standard security rules in the standard security rules repository that do not have a corresponding security rule in the security rules set data structure, to the security rule set data structure as part of the modified security rule set data structure.

9. A computer program product comprising a computer readable storage medium having a computer readable program stored therein, wherein the computer readable program, when executed on a computing device, causes the computing device to implement an advanced rule analyzer that operates to:
perform natural language processing of a security rule set data structure, specifying a plurality of security rules, to identify textual descriptions of tests performed by each of the security rules in the security rule set data structure;
execute, for each security rule pairing comprising a pairing of a first security rule in a plurality of securit

Assignees

• IBM

Inventors

• Bhatia Aankur
• Dwyer Paul J
• Huang Yiye

Classifications

• G06F40/30

  Semantic analysis · CPC title

• G06F21/552 Primary

  involving long-term monitoring or reporting · CPC title

• G06F40/284

  Lexical analysis, e.g. tokenisation or collocates · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/0263

  Rule management · CPC title