Patent application EP20201899A (EP), filed 2020-10-14
Publication number: EP3757846A2
Title: ANALYZING DIVERSELY STRUCTURED OPERATIONAL POLICIES
Abstract: [0001]    Disclosed embodiments relate to systems and methods for automatically processing diversely structured operational policies. Techniques include identifying a policy associated with an application or computer code; applying a language processing protocol to the policy to interpret the policy and extract attribute(s) of the policy, where the policy is defined using a vocabulary and syntax; normalizing the policy to define the policy using a standardized vocabulary and syntax agnostic to an infrastructure or service associated with the application or computer code, where one or more of the vocabulary and syntax are respectively different from the standardized vocabulary and syntax and where normalizing the policy comprises translating the attribute(s) of the policy; and evaluating the policy based on the normalizing to determine whether a potentially malicious activity is associated with the application or computer code.
IPC codes: G06F  21/    62            A I
H04L  29/    06            A I
G06F  21/    55            A I
G06F  21/    60            A I
H04L   9/    40            A I
Claims: number: 1
text: A computer-implemented method for automatically processing diversely structured permission, operational, or security policies, the method comprising:
number: 2
text: The method of claim 1, wherein the normalizing comprises:
identifying a set of rules related to the first policy using machine learning applied to previously normalized policies.
number: 3
text: The method of claim 2, comprising analyzing the first policy based on the normalizing using the set of related rules to determine one or more of:
number: 4
text: The method of any of claims 1 to 3, comprising:
analyzing the first policy based on the normalizing using a set of predefined rules to determine whether a potentially malicious activity is associated with the first application or the first computer code.
number: 5
text: The method of claim 4, wherein the analyzing comprises:
number: 6
text: The method of any of claims 1 to 5, wherein the evaluating comprises:
number: 7
text: The method of claim 6, comprising:
number: 8
text: The method of claim 4 or 5, comprising: applying machine learning to identify the one or more policy clusters based on the plurality of normalized policies.
number: 9
text: The method of claim 7 or 8, wherein the one or more policy clusters are identified by grouping policies based on one or more of: a number of permissions defined by a policy, resources associated with the permissions defined by the policy, a number of times the permissions are used by a respective entity or user, a policy structure, a type of service associated with the policy, a number of conditions defined by the policy, a type of the conditions defined by the policy, metadata usage, time, or a network location associate with the policy.
number: 10
text: The method of any of claims 1 to 9, comprising:
number: 11
text: The method of any of claims 1 to 9, wherein the determining whether a potentially malicious activity is associated with the first application or the first computer code is performed synchronously with execution or implementation of the first policy.
number: 12
text: The method of any of claims 1 to 11, wherein the identifying the first policy comprises scanning for: a newly created policy, a policy being modified, a policy being assigned to an entity or an identity, or a communication relating to a policy.
number: 13
text: The method of any of claims 1 to 12, comprising:
providing the normalized first policy to a control application for the evaluating, the control application configured to: control activity associated with an identity, and/or with the first application or the first computer code.
number: 14
text: The method of claim 13, wherein the control application is configured to:
number: 15
text: The computer-implemented method of claim 13 or 14, wherein the control application is configured to process the normalized first policy, but is not configured to process the first policy.
number: 16
text: The method of any of claims 1 to 15, comprising:
number: 17
text: A computer-readable medium storing instructions that, when executed by at least one processor, cause the at least one processor to perform the method of any of claims 1 to 16.
Office action: search_report, dated 2020-12-30
Rejection reasons: novelty_epc_54
Prior art cited: ref_id: US2008244693
ref_type: patent
severity: background
ref_id: US2016212169
ref_type: patent
severity: novelty_destroying
ref_id: - AMANI ABU JABAL ET AL, "Methods and Tools for Policy Analysis", ACM COMPUTING SURVEYS, ACM, NEW YORK, NY, US, US, (20190204), vol. 51, no. 6, doi:10.1145/3295749, ISSN 0360-0300, pages 1 - 35, XP058426014 [A] 1-17 * Section 4.3.2 *
ref_type: npl
severity: background
Final disposition: pending (2020-12-30)