Security policy selection based on calculated uncertainty and predicted resource consumption

Patent metadata

Field	Value
Publication number	US-12192243-B2
Application number	US-202217990511-A
Country	US
Kind code	B2
Filing date	Nov 18, 2022
Priority date	Nov 18, 2022
Publication date	Jan 7, 2025
Grant date	Jan 7, 2025

Abstract

A computer-implemented method according to one embodiment includes receiving a request to perform a security policy implementation analysis for a first deployment associated with a first client in an IT environment. IT information associated with the first deployment is collected. The method further includes applying trained machine learning models to analyze the IT information of the first client to compute a security policy for the first deployment. The security policy is computed based on a calculated uncertainty of effects that applying the security policy to the first deployment is capable of causing, and a predicted amount of resources of the first deployment that applying the security policy to the first deployment would consume. An indication of the security policy is output for display in a dashboard on a display of a user device of the first client.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
receiving a request to perform a security policy implementation analysis for a first deployment associated with a first client in an IT environment;
collecting IT information associated with the first deployment;
applying trained machine learning models to analyze the IT information of the first client to compute a security policy for the first deployment,
wherein the security policy is computed based on a calculated uncertainty of effects that applying the security policy to the first deployment is capable of causing, and a predicted amount of resources of the first deployment that applying the security policy to the first deployment would consume;
outputting an indication of the security policy for display in a dashboard on a display of a user device of the first client;
training the machine learning models to analyze IT information; and
storing the trained machine learning models to a predetermined database, wherein training the machine learning models includes: retrieving IT information associated with a second deployment of a training IT environment; computing risk level errors from components of the second deployment and applications of the second deployment; transforming the IT information into training datasets for the machine learning models; training a first of the machine learning models using a first of the training datasets, wherein the first of the machine learning models is trained for calculating uncertainty; and training a second of the machine learning models using a second of the training datasets, wherein the second of the machine learning models is trained for predicting resource consumption.

2. The computer-implemented method of claim 1 , comprising: receiving an indication of a degree of risk that the first deployment is currently capable of supporting in the IT environment, wherein the indication of the security policy includes a plurality of recommended security parameters, wherein each of the recommended security parameters are tiered according to how the recommended security parameter conforms to the degree of risk.

3. The computer-implemented method of claim 1 , wherein the indication of the security policy includes a breakdown of a plurality of applications associated with the IT information, wherein the breakdown includes, for each of the applications, a security competency issue, and an issue specific uncertainty level, wherein the calculated uncertainty of effects that applying the security policy to the first deployment is capable of causing is based on each of the issue specific uncertainty levels.

4. The computer-implemented method of claim 1 , wherein the effects that applying the security policy to the first deployment is capable of causing is selected from the group consisting of: a collateral effect that the applying the security policy would cause to customer features offered by applications of the first deployment, private customer information unintentionally becoming accessible, a loss of access event, and a loss of functionality of components of the first deployment, wherein the resources of the first deployment are selected from the group consisting of: administrator time, costs incurred by the first client, subject matter expert (SME) consultation, processing operations being devoted to troubleshooting operations, and time consumed in updating applications associated with the first deployment.

5. The computer-implemented method of claim 1 , wherein the security policy is computed from a plurality of potential security actions identified from results of applying the trained machine learning models, wherein the potential security actions are used as an input for a predetermined genetic algorithm used in the computation of the security policy.

6. The computer-implemented method of claim 1 , comprising: determining an IT service provider that offers a service that has at least a predetermined degree of similarity with the security policy; and outputting an indication of the determined IT service provider to the user device.

7. A computer program product, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to:
receive, by the computer, a request to perform a security policy implementation analysis for a first deployment associated with a first client in an IT environment;
collect, by the computer, IT information associated with the first deployment;
apply, by the computer, trained machine learning models to analyze the IT information of the first client to compute a security policy for the first deployment,
wherein the security policy is computed based on a calculated uncertainty of effects that applying the security policy to the first deployment is capable of causing, and a predicted amount of resources of the first deployment that applying the security policy to the first deployment would consume;
output, by the computer, an indication of the security policy for display in a dashboard on a display of a user device of the first client;
to train, by the computer, the machine learning models to analyze IT information; and
store, by the computer, the trained machine learning models to a predetermined database, wherein training the machine learning models includes: retrieving IT information associated with a second deployment of a training IT environment; computing risk level errors from components of the second deployment and applications of the second deployment; transforming the IT information into training datasets for the machine learning models; training a first of the machine learning models using a first of the training datasets, wherein the first of the machine learning models is trained for calculating uncertainty; and training a second of the machine learning models using a second of the training datasets, wherein the second of the machine learning models is trained for predicting resource consumption.

8. The computer program product of claim 7 , the program instructions executable by the computer to cause the computer to: receive, by the computer, an indication of a degree of risk that the first deployment is currently capable of supporting in the IT environment, wherein the indication of the security policy includes a plurality of recommended security parameters, wherein each of the recommended security parameters are tiered according to how the recommended security parameter conforms to the degree of risk.

9. The computer program product of claim 7 , wherein the indication of the security policy includes a breakdown of a plurality of applications associated with the IT information, wherein the breakdown includes, for each of the applications, a security competency issue, and an issue specific uncertainty level, wherein the calculated uncertainty of effects that applying the security policy to the first deployment is capable of causing is based on each of the issue specific uncertainty levels.

10. The computer program product of claim 7 , wherein the effects that applying the security policy to the first deployment is capable of causing is selected from the group consisting of: a collateral effect that the applying the security policy would cause to customer features offered by applications of the first deployment, private customer information unintentionally becoming accessible, a loss of access event, and a loss of functionality of components of the first deployment, wherein the resources of the first deployment are selected from the group consisting of: administrator time, costs incurred by the first client, subject matter expert (SME) consultation, processing op

Assignees

• Kyndryl Inc

Inventors

• Pereira Robson
• Fida Leandro Cesar
• Montanhini Edson Jose
• Varga Sergio
• Marchiori Daniele Jaqueline

Classifications

• H04L63/105

  Multiple levels of security · CPC title

• G06N20/00

  Machine learning · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• G06F21/57 Primary

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title