Systems and methods of implementing security context aware response time optimization

Patent metadata

Field	Value
Publication number	US-11630899-B2
Application number	US-201916529709-A
Country	US
Kind code	B2
Filing date	Aug 1, 2019
Priority date	Aug 1, 2019
Publication date	Apr 18, 2023
Grant date	Apr 18, 2023

Abstract

An information handling system may include a processor to execute code of a threat level detection module to receive and store in memory labeled data descriptive of operating environment variables related to the information handling system including operating environment variables selected from a basic input/output system (BIOS) setting, an information handling system hardware setting, and at least one of an operating system (OS) environment setting, a developer tool access setting, or a network setting; the processor to determine, via execution of a machine learning process of the threat level detection module, a threat level value; and a security module associated with a first application executed on the information handling system to: map the threat level value with the first application; and adjust the security level associated with the first application based on the provided threat level value to modify security checks operating with the first application.

First claim

What is claimed is:

1. An information handling system, comprising:
a hardware processor to execute code instructions of a threat level detection module to receive and store in memory labeled data descriptive of operating environment variables related to the information handling system including a basic input/output system (BIOS) setting, and an information handling system hardware setting;
the hardware processor to execute code instructions of a threat level detection module to further receive and store in memory labeled data descriptive of operating environment variables including at least one of an operating system (OS) environment setting, a developer tool access setting, or a network setting;
the hardware processor to determine, via execution of a machine learning module of the threat level detection module, a threat level value; and
the hardware processor executing code instructions of a security module associated with a first application executed on the information handling system to:
map the threat level value with the first application; and
adjust the security level associated with the first application based on the provided threat level value to modify security checks operating with the first application,

wherein modifying the security checks operating with the first application includes forgoing a digital signature check related to the execution of the first application by the hardware processor when the provided threat level value meets a safe categorization.

2. The information handling system of claim 1 , wherein the hardware processor executes code instructions of a categorization engine to categorize the received operating environment variables to track which of the operating environment variables are integral to the machine learning module for threat level value determination.

3. The information handling system of claim 2 , wherein mapping of the threat level value with the first application includes mapping the threat level value and a context determined for any determined unsafe threat level values to the security checks operating with the execution of the first application, wherein the security checks relate to a category of received operating environment variables.

4. The information handling system of claim 1 , wherein the threat level value is indicated as one of a safe threat level value or an unsafe threat level value with the unsafe threat level value providing a context value describing how the unsafe threat level value is unsafe relative to an execution of the first application.

5. The information handling system of claim 1 , wherein the operating environment variables are derived from a determination of whether the information handling system is communicatively coupled to a network or network location that is at risk of compromise.

6. The information handling system of claim 1 , wherein the operating environment variables are derived from a determination of whether BIOS settings, information handling system hardware settings, or the OS settings render the information handling system are vulnerable.

7. The information handling system of claim 1 , wherein the operating environment variables are derived from a determination of whether an external device is communicatively coupled to the information handling system.

8. The information handling system of claim 1 , wherein the threat level detection module and the categorization engine operating with the threat level detection module are trained before release with the information handling system with telemetry data from other information handling systems.

9. The information handling system of claim 1 , wherein the threat level detection module is deployed with another factory-installed software system having APIs for the information handling system.

10. A method of dynamically scaling security settings on an information handling system, comprising:
detecting, with a threat level detection module code instructions executed by a hardware processor of the information handling system, labeled data descriptive of operating environment variables related to the information handling system including a basic input/output system (BIOS) setting, an information handling system hardware setting, and an operating system (OS) environment setting;
detecting, with a threat level detection module code instructions executed by a hardware processor of the information handling system, labeled data descriptive of operating environment variables related to the information handling system further including at least one of a developer tool access setting, or a network setting;
determining, via execution of code instructions of a machine learning module, a threat level value associated with the information handling system based on the labeled data descriptive of the operating environment variables;
executing code instructions of a security module via the hardware processor:
to map the threat level value with security measures conducted by a first application executed by the hardware processor; and
to adjust a security level associated with the first application based on the determined threat level value being safe including modifying security checks operating with the first application by forgoing a digital signature check related to the execution of the first application by the hardware processor; and
to maintain a security level associated with the application based on the determined threat level value being unsafe for the mapped security measures related to the unsafe threat level classification value.

11. The method of claim 10 , comprising categorizing the operating variables to track which of the operating variables are integral to the application or not.

12. The method of claim 10 , wherein determining, via execution of code instructions of a machine learning module, a threat level classification value associated with the information handling system based on the labeled data descriptive of the operating environment variables includes the threat level being indicated as either a safe threat level classification value or an unsafe threat level classification value with the unsafe threat level providing context describing how the threat level is unsafe relative to an execution of the application.

13. The method of claim 10 , wherein the operating variables are derived from a determination of whether unsafe basic input/output system (BIOS) or the operating system (OS) includes settings that render the BIOS or OS vulnerable.

14. The method of claim 10 , wherein the operating variables are derived from a determination of whether an external device is communicatively coupled to the information handling system.

15. An application optimization information handling system, comprising:
a hardware processor to execute code instructions of a threat level detection machine learning module;
the hardware processor to execute code instructions of a security module associated with first application executed by the hardware processor to:
dynamically receive, from the threat level detection machine learning module, a dynamic threat level value based on operating environment variables selected from:
a basic input/output system (BIOS) setting;
an information handling system hardware setting; and
at least one of an operating system (OS) environment setting, a developer tool access setting, or a network setting; and

adjust a security level associated with the first application based on the dynamic threat level value indicating a safe threat level classification value to reduce implemented security measures wherein the adjustment to the security level includes a modification

Assignees

• Dell Products Lp

Inventors

• Vichare Nikhil M
• Arora Mohit
• Tan Danilo O

Classifications

• G06F21/57

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• G06F21/55

  Detecting local intrusion or implementing counter-measures · CPC title

• G06F21/552 Primary

  involving long-term monitoring or reporting · CPC title

• G06N20/00

  Machine learning · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title