RU2514137C1 - Method for automatic adjustment of security means - Google Patents

Abstract

FIELD: physics, computer engineering.

SUBSTANCE: invention relates to automatic adjustment of security means when executing application programs. The method for automatic modification of security means comprises steps of: verifying if an application meets safety criteria; if the application meets the safety criteria, executing the application in test mode; switching the application execution scenarios; recording operations performed by the security means while executing application scenarios, wherein operations associated with the executed application are recorded; determining priorities for the recorded operations; creating a set of instructions which modify the security means, wherein modification of the security means enables the security means to perform operations depending on said priority; modifying the security means by executing the formed set of instructions.

EFFECT: reducing the amount of computational resources consumed by the security means when executing an application program without loss of quality of security.

20 cl, 5 dwg

Description

Technical field

The present invention relates to methods for ensuring the security of computer systems, and more particularly to methods for automatically configuring security tools during execution of application programs.

State of the art

To ensure the maximum level of protection of computer systems (CS) from an ever-increasing number of threats to computer security, manufacturers of security tools for computers and networks are constantly developing and improving methods for detecting malicious programs and their components. Along with this, the resource consumption of security solutions and the number of possible settings are increased. Thus, a new technical task is being formed in the field of CS security - to optimize the operation of security tools depending on the configuration of the CS for each trusted user application or application group. Optimization eliminates detection errors, does not perform additional ineffective checks in order to minimize resource use, and also correctly configures security tool components so that the user application works without additional resource restrictions and conflicts with the security tool. At the same time, optimization should not lower the necessary level of security provided by the security equipment of the CS. The optimization process should be fully automated or take place with minimal involvement of the user (administrator). This, in particular, does not allow the principle of the least possible privileges to be realized, namely that a trusted application should not receive full privileges, but a limited set of rights necessary for normal functioning.

In most existing security systems that control applications, the optimization process is limited to updating black and white lists of applications, which does not allow to differentiate settings for two trusted applications that are in the white list.

Systems are known in the art in which separate security policies are applied for some programs. An example of such applications is mail clients, for the security of which they increase the level of network protection by increasing the power of network filters and apply a detailed check of files attached to letters for malicious objects. Another example of optimizing application control is the operation of the antivirus in a special mode while the game application is running. At the same time, the antivirus service consumes the least possible amount of computing resources, delays the launch of scheduled tasks and changes a number of other settings so as not to create conflicts with the game application.

The computer security tool, in particular, the antivirus has a limited number of settings. The formation of a database of settings and their application depending on the configuration, user, location of the CS and other factors is a trivial task if the corresponding configuration is manually created by the administrator of the CS or is set by direct correspondence, for example, using a table or a set of expert rules. Thus, services are known from the prior art that allow you to configure access control by downloading the appropriate profiles from a remote administration server described in publications US 7197550, US 20070209076. The solutions proposed in the descriptions configure the security system, in particular, configure the access control system based on the information About the user and the running application. In contrast to the existing technique, the invention described below allows for more precise security tuning of the user's computer by automating the process of analyzing the user application and system configuration, which reduces the consumption of computing resources of the user's computer and, at the same time, applies effective protection measures with respect to the application and the host itself.

US 7979849 and US 20110314343 describe software testing tools based on the study of graphical interfaces and software processes. A distinctive feature of the claimed invention is an improved method of researching a program not only by maintaining event logs, but also by emulating various conditions for program execution, collecting statistics and simulating effects on the program interface.

An analysis of the prior art and the possibilities that arise when combining them allow you to get a new result, namely, a way to automatically configure security features. Distinctive features and characteristics of the present invention are disclosed in more detail in the description of the embodiments.

SUMMARY OF THE INVENTION

The present invention is intended to automate the process of setting up a security tool during operation of an application program, taking into account the functional features of this program.

The technical result of the present invention is to modify the security tool to prioritize the operations performed by the security tool during execution of the application program.

Putting the invention into practice allows you to automatically change the security settings depending on the configuration of the computer system and its changes. When the application starts, certain security settings are automatically applied, which also vary depending on factors characterizing the current state of the computer system.

The technical result is achieved by analyzing the execution processes of the application program and security tools that are jointly executed on a computer system with various computer system configurations.

A method for automatically modifying a security tool consists of stages in which: (a) they check the application for compliance with security criteria; (b) if the application meets the security criteria, the application is launched for execution in test mode; (c) switch application execution scripts; (d) register operations performed by the security tool during the execution of application scripts, while registering operations associated with the executable application; (e) prioritize registered transactions; (e) form a set of instructions that modify the security tool, while the security tool modification ensures that the security tool performs operations depending on the priority mentioned; (g) modify the security tool by executing the generated set of instructions.

A method for researching applications for automatically configuring a security tool consists of stages in which: (a) the application is launched for execution in real mode on at least one computer system; (b) determine the script for the application in real mode; (c) register operations performed by the security tool during execution of the application script, while registering operations associated with the executable application; (d) check the application for compliance with security criteria; (e) if the application meets the security criteria, then priorities are determined for registered operations; (e) form a set of instructions that modify the security tool, while the security tool modification ensures that the security tool performs operations depending on the priority mentioned; (g) modify the security tool by executing the generated set of instructions.

In various implementations, each or a combination of the following conditions is used as security criteria: the presence of a digital signature of the application; lack of malicious objects in the application; lack of vulnerabilities in the application; compliance of the security rating with the trusted.

A test execution mode of an application in one embodiment is implemented by executing the application in an emulated environment. Another embodiment of the test mode is the use of a simulator of the actions of a user of a computer system when executing an application. The test mode of application execution in a particular embodiment is implemented using a simulator of actions of a user of a computer system while executing an application in an emulated environment.

The real mode of application execution in one of the implementation options is carried out by executing the application on the processor and in the memory of the computer system during the interaction of the user of the computer system with the application.

Switching application execution scenarios in various implementations is carried out by changing the application settings and / or by calling at least one user function of the application. The application execution scenario in a particular embodiment is determined by setting up the application and / or calling at least one user function of the application.

Registration of application and security operations in one implementation includes intercepting calls to operating system functions.

The priorities of the operations performed by the security tool in a particular embodiment are determined in such a way that the minimum priority value corresponds to the exception of the operation. The maximum priority value in a particular embodiment corresponds to the operation at the first technical opportunity.

A method for automatically modifying a security tool and a method for researching applications for automatically configuring a security tool in various configurations of a computer system and a computer network are implemented on one or more computer systems. In the case where the method is implemented on at least two computer systems, the application is executed on a computer system other than the one where the security tool is installed.

To use the generated set of instructions on computer systems other than the one for which the automatic modification of the security tool was used, a particular embodiment further includes the step of storing the generated set of instructions.

Brief description of the attached drawings

The accompanying drawings, which are included to provide an additional understanding of the invention and form part of this description, show embodiments of the invention and together with the description serve to explain the principles of the invention.

The claimed invention is illustrated by the following drawings, in which:

Figure 1 shows a functional diagram of a system for analyzing application and antivirus compatibility.

Figure 2 shows a control scheme for automatic configuration in a corporate network.

Figure 3 shows a method for automatically configuring a security tool.

Figure 4 shows the security configuration algorithm in the process of operation of the COP.

5 shows an example of a general purpose computer system.

Description of Preferred Embodiments

The objects and features of the present invention, methods for achieving these objects and features will become apparent by reference to exemplary embodiments. However, the present invention is not limited to the exemplary embodiments disclosed below, it can be embodied in various forms. The essence described in the description is nothing more than specific details to assist the specialist in the field of technology in a comprehensive understanding of the invention, and the present invention is defined only in the scope of the attached claims.

An application or application is a program designed to perform certain user tasks and designed for direct interaction with the user. In most operating systems, applications cannot access the resources of the CS directly, but interact with equipment and system resources through the operating system. A computer program is a combination of a sequence of commands designed to control the devices of the CS in order to implement a certain algorithm, and the data used to execute these commands. In the context of this document, programs such as applications, i.e. programs that have at least a console management interface and solve specific user tasks. Examples of applications are office programs for working with electronic documents, communicators, web browsers, computer games and many other applications.

Each application for solving user tasks uses various system resources, including devices, files, system services, which are accessed through the API functions (Application Programming Interface) of the operating system or runtime. Each application has many settings, functionalities available to the user or administrator through some interface.

There are many ways to organize interfaces. The first way to organize user interaction with a computer is a text user interface. An example of such an interface is the management console, through which information is entered and commands are indicated. Moreover, the display of information is also carried out in text or pseudographic format. The text interface implements all the basic controls of the menu program, buttons, switches, flags, drop-down lists, scroll bars, and so on.

The most common type of program interface is a graphical user interface (GUI), in which application elements (menus, buttons, icons, lists) are made in the form of graphic images. Unlike the command line interface, in the GUI, the user has access to all visible display objects and directly manipulates them. There are also several options for implementing GUI. The window interface technology, which is implemented in most operating systems, including Windows, MacOS, Palm OS, GEM, and others, is very popular among developers. The implementation of such an interface consists in designing control elements (including standard forms or developing original elements) and processing events caused by user actions and program logic. Another popular GUI implementation is the web interface - i.e. A set of controls and displays that use browser capabilities. Typically, the web interface is used to work with remote services, such as databases, as a client application. The implementation of web interfaces is based on technologies such as JavaScript, HTML, CSS, Adobe Flash, Silverlight, Ajax and others.

Application management can also be done without using a user interface. For this, administrative tools are used or direct modification of application resources (files, registry keys, process, memory, etc.) is performed. To make changes to the application, a certain command can be received, both local and network, application files, for example, a configuration file, are changed.

Execution of the application with a certain set of settings from the moment the control signal is applied to the application until the application completes processing of this signal will be determined as the application execution script within the framework of this description. The functionality of the application can be represented as a set of a finite number of scenarios. Such a logical division of the application into functional blocks allows you to get a more explicit idea of the capabilities and functions of the program when testing an unknown application. Information about what functions are used and what resources are needed for the program to work correctly allows you to configure the security tool more accurately. In the description below, the relationship between the application functionality and the settings of the security components that are part of the security tool will be described in more detail.

To reliably ensure the security of the CS, it is necessary to implement a security system consisting of software and hardware modules installed both on the CS and on external network nodes. Network nodes are computers, servers, and network equipment that provides communication between computers and servers. Optimization of the security system for collaboration with the application involves fine-tuning all composite modules.

Security tools, depending on their specialization, are designed to check files for malicious objects, filter network traffic, analyze software processes, filter email messages, protect against unauthorized access, prevent intrusions, detect network anomalies, and others. Such a variety of defenses is explained by the constant growth of malware, attacks on corporate computer networks and the emergence of new types of threats aimed at new network resources.

As an example, the configuration of a security tool installed on the same CA on which the application is running will be considered below. In other implementations, the application functionality may also affect the optimization of the operating parameters of the security tool installed on a different network node, different from where the application is running.

A key element of protection for the COP is the antivirus. Modern anti-virus solutions include functionality that goes beyond scanning files for malicious code. In this document, the antivirus should be considered as a synonym for the security tool for the COP. Depending on the version of the anti-virus tool, the functionality includes CS protection, information protection, parental control, control and synchronization modules with other security tools.

COP protection is designed to fight against known and new threats, network attacks, fraud, spam and unwanted information. Each type of threat is handled by a separate protection component. Independently of each other, you can turn protection components on and off, as well as configure their operation. In addition to the real-time protection provided by the protection components, tasks of periodic verification of the CS are formed to exclude the possibility of the spread of malicious programs that were not detected in the first stages of the scan.

Real-time protection of the CA is carried out by such components,

as:

file antivirus, which scans all opened, saved and launched files on the CS and on all mapped drives;

mail antivirus that scans incoming and outgoing mail messages;

Web antivirus that monitors the execution of scripts on websites, scans web traffic and blocks access to dangerous websites;

IM anti-virus, which provides security for instant messaging;

a proactive defense component that allows you to prevent the execution of a malicious operation based on monitoring and analyzing the behavior of all programs installed on the CS.

an application control component that regulates the activities of programs, including controls the access of applications to various resources, based on which group the component relates to this program;

a firewall that provides security in local networks and the Internet, filtering network traffic and blocking abnormal activity;

anti-spam, which checks all incoming mail messages for spam.

Information protection implies respect for the integrity, confidentiality and accessibility of data and is ensured by the following anti-virus functions:

backup, which allows you to back up data in a special storage and restore data in case of data loss;

data encryption, which provides additional protection for confidential data, placing data in encrypted containers or performing full disk encryption;

password manager that stores passwords from Internet accounts, programs and databases in a special protected space.

The parental control component makes it possible to establish flexible restrictions on access to Internet resources and programs, as well as to report user activities on the CS.

The control center is used in cases where the user works in a home network from several CSs, and is necessary to ensure an equally high level of security for each network device. Management and synchronization modules update anti-virus databases and components, manage scan tasks and security incidents, accumulate reports on the operation of anti-virus services and provide remote management of them.

Each of the listed anti-virus components has certain settings that can be changed. Besides the fact that the component can be turned on or off, there is also the opportunity to change the parameters of its operation. Most detection tools are based on rules based on clear and fuzzy comparisons. Therefore, setting up the components includes at least changing the lists of signatures of malicious objects and threats and / or changing thresholds for analyzers. More fine-tuning, consisting in changing the detection algorithms, is carried out by updating the anti-virus components.

As a rule, each component of the antivirus analyzes a certain type of objects, thus updating the signatures of objects of the corresponding class will be the setting of one or more components of the antivirus.

There are several main types of objects that are processed by analyzers to identify malicious functionality or threats: resource address, network packet, file, message (email), device, software process (stream, operation). Each of these types can be characterized by a set of parameters.

For a file, these parameters are: name, size, hash, digital signature, the path to the file on disk, the platform for opening or starting the file, etc. By the set of parameters, it is possible to identify the necessary file. Heuristic analyzers that are based on behavioral signatures are also used to identify the executable file. Behavioral signatures can be different, for example, they can be lines of source codes, program execution paths or call graphs.

A network packet is characterized by a data transfer protocol, the contents of the headers and the body of the packet (contents of the data field). The third type of objects, the address of the resource, which indicates the location of the malicious or unwanted object, is set by the mailing address, network address, domain name, host name, physical address, network port, etc. It is also worth highlighting such a type as the account under which it works user. This may be useful for restricting privileges for a given user.

An e-mail is understood as an e-mail message, an ICQ message, Skype, Messenger and other quick messaging services. These objects are examined for spam using lexical and graphic signatures and filtered by the mail addresses of senders (recipients).

Another type of object that can be blacklisted or whitelisted is a device. Under the device in this context refers to an external storage device, input / output device, multimedia, for example, a player or a camera. They can be identified by serial number, manufacturer and model.

Application control is based on maintaining and analyzing the history of operations performed by the application. Although this protection method refers to heuristic detection methods, and not signature methods, the rules used in assessing the security of an application are superimposed on the operations and resources of the application. Thus, it is worth highlighting another type of objects that are processed by the antivirus - software processes. This type refers to individual operations or sets of operations that make up one or more system events of a computer, for example, calling an operating system function, directly accessing a device, reading memory, and other actions.

The above classification of objects stored in the white and black lists of the anti-virus database is an example and does not limit the list of objects stored in the database.

During the operation of the application, the antivirus, depending on the application execution scenarios, will process various types of objects listed above. This invention allows to reduce the number of actions performed by the antivirus to check the operation of the application, if the application is recognized as trusted. At the same time, a complete shutdown of the protection components during the operation of the trusted application can lead to infection, data loss and other harm to the user or company, therefore, the configuration should be made based on the study of the application and adapted to the application execution scenario. The solution to this non-trivial task allows us to provide effective protection for the CS and information processed on the CS, while reducing the amount of computing resources.

To determine the degree of trust in the application, there are a number of criteria, each or part of which the application must meet. Application security criteria include the following factors: digital signature; reputation of the copyright holder of the facility; statistics on the use of this object, collected from many CS; lack of evidence of known malicious or unwanted objects; lack of critical vulnerabilities in the current version of the application; Examination of the application in the anti-virus laboratory. This list of criteria is provided as an example and is not exhaustive.

The user or administrator can edit the list of trusted applications by adding or removing applications from it, as well as change the criteria for automatically adding an application to the list of trusted applications. An example of a rule set by a user or administrator can look like this: “Add all programs released by Microsoft to the list of trusted applications” or “Exclude all programs without a digital signature from the list of trusted applications."

Another use case of the claimed invention is to configure an antivirus to ensure the security of critical applications. Such applications may include client programs for financial transactions, programs that process confidential information or poorly protected programs. In this case, the application may be trusted, but requires constant monitoring. If you turn on all anti-virus components at the same time at the maximum level of protection (set the maximum scan depth), the load on the processor and memory will increase so much that it will create problems for the implementation of user tasks at various intervals. At the same time, some of the antivirus functionality, depending on the current application execution scenarios, will not bring a useful contribution to improving the security level of the CS and the processed data. Providing an effective level of protection with minimal consumption of computing resources for critical applications is the second task that this invention solves.

Let us consider in more detail the process of analyzing the compatibility of the application and the antivirus on the functional diagram of one of the implementation options shown in Figure 1. The proposed implementation option implies the execution of application 120 in a real or emulated computer system, but this example does not limit the application of the concept of testing application compatibility and security in static mode, for example, using disassembly and semantic analysis.

Interacting with the application 120 through the interface 121 or making direct changes to the code of the application 120, the user 100 and the administrator can perform application management: configure, call the application functions, install and update application components, etc. The actions of user 100 can be reproduced artificially using a simulator 110. During execution, the application interacts with the file system 191 — reads and writes, creates and deletes files; with network interfaces 193 - receives and sends data over the network; with input-output devices 194 - processes data entered from the keyboard or using manipulators; with services of OS 192 and with other software and hardware components of the computer. The application interacts with the components through the API functions of the operating system 125. It is the called API functions that determine the functionality implemented in the application, and are also used by the antivirus to analyze the security of the application and the processed data.

Most antiviruses intercept calls to operating system functions by implementing their own handler 131. This can be implemented in various ways: installing the driver, modifying the kernel of the operating system, and other known methods. In this case, the antivirus can process a limited set of function calls, which includes critical functions used by cybercriminals to perform malicious actions. The diagram shows a recorder 141, which is also designed to track the sequence of actions performed by the application, but is not limited to a specific list of operations, but registers all the actions performed by the application. In other embodiments, the antivirus engine 131 and the registrar 141 are implemented in one module.

Having received information from the handler 131 about the intercepted call to the API function, the antivirus 130 scans the action itself and the objects to which this action is addressed. For example, an application performs an operation with a file, then the antivirus checks the access of the application and the user to the file, the ability to read and modify this file by the application, the presence of malicious or potentially dangerous objects in the file. During the operation of the antivirus 130 and the application, the operation logs of the antivirus and the application are kept. Logs 150, 151 are synchronized in such a way that application operations and antivirus operations are related by a causal relationship. This means that each action of the antivirus can be associated with an action or set of actions of the application, which were the basis for the antivirus scan. Logging 150, 151 allows you to determine the inverse relationship to establish what actions with the application will lead to the operation of the antivirus, and, more specifically, to the operation of a specific component of the antivirus.

For trusted applications, the antivirus can be optimized by adding the resources used by the application to the list of trusted objects that will be excluded from scan tasks. You can set possible simplifications in the operation of the antivirus while ensuring application security using expert rules, which are replenished by information security specialists. It is important to note that a special anti-virus configuration does not just exclude trusted objects from scans, but sets up components depending on the type of object and functional load (some components exclude scanning, some increase, for others, the scan depth is indicated).

As noted earlier, the configuration of anti-virus components is not limited to updating signature databases. The rules of operation of individual modules can also be adjusted. A great contribution to the optimization of the antivirus can be made by changing the rules and parameters of application control tools. For example, a technology based on evaluating the reputation rating of a software process has a large number of configurable parameters, which are used in many modern antiviruses in various implementations. A more detailed description of the technology is available in the publication of the patent for utility model RU 101233.

The use of reputational threat detection methods allows you to separate programs, not only trusted and malicious, but also to identify potentially dangerous programs that are subject to restrictions depending on the rating value, which, as a rule, is expressed in relative values and ranges from "0" to " 100 percent. The rating has two components: static and dynamic. Before starting the file, the application control module analyzes the following parameters: file name, file size, file location, compression parameters, file sources. These criteria determine the static rating of a file. Thus, the use of this invention will eliminate completely or significantly reduce the process of calculating the static component of the rating for a trusted application. In the process of executing the application (on the host or in the emulator), the second component of the rating is calculated - dynamic. To do this, the application control module monitors the actions of the program and assesses the risk of danger for each of them according to the predefined evaluation criteria. For trusted applications, the application of the described invention may consist in changing the evaluation criteria, for example, in reducing the risk to each fixed action or set of application actions. Attempting to write and read the memory of another process, creating executable files, trying to modify system files and the system registry, processing confidential information, deleting files outside the application directory, registering drivers and services, and many other actions that are suspicious from the point of view of computer security increase the dynamic component of the rating. At the same time, for a trusted application, the application of the described fine-tuning technology will reduce the number of checks, excluding some operations from rating rating factors. Having received a total rating, the antivirus restricts those processes whose rating is too high (i.e. they are potentially dangerous).

To limit the use of resources, the IPS system is used (Intrusion Prevention System - an intrusion prevention system that combines proactive protection and a firewall, which controls file, registry, system permissions, etc.). For hazardous processes, you can prohibit the use of network and Internet access, restrict the use of memory, etc. Each rating rule has its own parameters, such as an identifier, an API function, conditions for arguments (which specify a range of values for a certain danger level in percentage terms), an estimate in percentage of the number of operations (1, 2-3, more 3 operations), a decision on the possibility of recognizing the process as malicious on the basis of this rule. Fine-tuning the antivirus for a trusted application can specify a list of rule identifiers by which the application will be controlled and restrictions are imposed, and it can also change the rule settings, for example, indicate that none of the rules can recognize a file as malicious.

The following are examples of fine-tuning the antivirus for applications of various types, with which the antivirus most often comes into conflict due to application functions that are close to abnormal or malicious.

For network utilities, such as a network scanner, the antivirus often produces false positive errors, as applications of this type perform actions similar to malicious programs that collect information about the network configuration and search for vulnerabilities for infection and operation of computers. When using such applications, it is necessary to disable the protection component against network attacks and check the traffic with a web antivirus.

A feature of applications for distributed file sharing (Torrent clients) is the generation of a large amount of incoming and outgoing network traffic, the active reading and writing of files from disk to disk, respectively. Thus, the optimization of the antivirus checking the operation of the torrent client should exclude the verification of temporary and downloaded files. For each CS, application parameters, such as the disk location directory, application configuration file, version, and other parameters may vary. Automate the collection of information about this particular application and adapt the setting, for example, using a script (script). The script first searches for registry keys, directories and files, reads the data necessary for applying the settings, and then, based on the collected information, applies the anti-virus settings taking into account the features of this CS. To adapt the antivirus to the functionality and configure the distributed file sharing application, the script performs the following actions:

- it is determined whether the application is running;

- scanned application directories to search for configuration files;

- the directories of temporary files and downloaded files are determined, after which the directories are added to the list of exceptions when scanning files by the antivirus upon access;

- Connection ports opened by the application are determined and exceptions are added to the firewall;

- the maximum level (depth) of checking downloaded files when opening files by another application is set.

The ability to adapt settings in automatic mode is not the only positive effect of using auto-tuning scripts. Periodic launching of scripts allows you to detect changes in the configuration of applications, for example, when changing directories of stored files or version of an application, and apply current settings for a security tool.

Another illustrative example of the use of fine-tuning scripts is the configuration of the antivirus on the database server to protect against network attacks and unauthorized access. To build effective and non-resource-intensive protection, you need to determine: the main services for the database, open ports and network addresses available for connection. Consider an example of antivirus configuration for working with the Oracle database server.

As a rule, several utility components are installed on the Oracle database server. You can determine the list of installed Oracle components by analyzing the registry key.

HKEY_LOCAL_MACHINE \ SOFTWARE \ Oracle. This key also contains information about the paths to the server root directories that store the listener.ora and tnsnames.ora configuration files. The first file contains connection settings (which ports and which interfaces the server listens on), and the second file contains settings for the client (client connection settings).

Based on the information received from the registry key and configuration files, the anti-virus components are configured that are responsible for monitoring applications and web anti-virus (traffic filtering). At the same time, connection filtering can be configured in such a way that the configured connections will pass freely without checking, and all others will be blocked by default by web antivirus.

Figure 2 shows the control circuit for automatic configuration in a corporate network that combines the KS (201, 202) and connected to the fine-tuning server 203. Applications (211-216) and security tools 220 are installed on the KS (201, 202). installed on different COPs may differ at least in version or settings. Computer system 201 has installed applications A 211, B 212, C 213, and computer system 202 has applications X 214, Y 215, Z 216. If you apply the same security policy to each CS, including the configuration of anti-virus components, the level of security provided for two CS with different installed applications it will be different, ceteris paribus (hardware configuration). The differences between the computing resources of the COP should also be considered when choosing a security policy. The fine tuning module 230 provides the optimal settings from the point of view of resource consumption, but effective from the point of view of security. This module can be executed as a separate server, be a part of the administration server, or can be installed on each COP. The fine-tuning module collects information about the CS, after which it searches for the necessary configuration scripts in the expert database 232, creates the corresponding task of changing the configuration of the CS and / or security tool 220 (antivirus) using the tool for generating configuration tasks 231. When the task starts, the configuration script is executed or transmitted for execution to the CS depending on whether the fine-tuning module is installed on the CS or on the remote server, respectively.

The expert database 232, used locally within the network or on individual devices, stores expert data: configuration scripts, the rules by which the required script is selected, and other supporting data needed to configure the CS and antivirus. Only the necessary information from the global database 244 supported by the fine-tuning server 203 is selectively loaded into the database 232. The choice of the downloaded data depends on the programs used on the network or on the computer, the geographical location, supported versions of security features.

Expert data is generated on the fine-tuning server 203. The application is examined taking into account statistical information and system logs downloaded to the log collection tool 241. Another option for analyzing the application is to study the compatibility of the application and the antivirus in the test execution environment 242, implemented, for example, using a simulator BY. The use of various methods for analyzing the compatibility of the application and the antivirus together allows you to determine the entire functionality of the application, highlight the functions of the application that trigger the antivirus, and adapt the security tool for this type of application or for each specific application (application version). The results of processing the logs and application execution in the test execution environment are used to update the anti-virus database with signatures of white (safe) and black (malicious) objects and to fine-tune trusted and critical applications. Scripts (sets of configuration instructions), examples of which are described above, are created by the configuration script generator 160. The scripts can be used on computers of various configurations. The input parameters for the script are: RAM capacity, processor power, application version, application location on disk, security model (antivirus version), parameters of the current security setting. Having determined the appropriate parameters for the CS, on which automatic tuning is performed, the script updates the lists of white and black objects (which are processed by this version of the antivirus), sets the anti-virus module controllers to the values corresponding to the input parameters. For example, for a computer with high performance and for an application with the function of downloading files from remote sources, the file scan depth will be set to maximum, and for a computer with a small amount of RAM and a trusted application with the function of playing media files from a remote resource, filtering traffic from verified network addresses can be disabled. The received configuration scripts and metadata for them are entered into the global database, from where they are loaded into expert databases. Script metadata contains: the identifier, application, or type of applications for which the script is configured, the platform for which the script was written, the time the script was issued, performance indicators for the script, a description of the modifications being performed, and other information that characterizes the script.

Figure 3 shows the algorithm of a method for automatically configuring a security tool. The method begins to work when a new unknown application is detected, for example, when the application is downloaded to the user's computer 300. You can also initiate the start of the method by scanning storage for programs, notifying the software manufacturer about the release of a new application, and manually starting it. After that, the application should be checked for compliance with security criteria 305 to determine if the application is trusted. If the application does not meet the security criteria, it is recognized as malicious, after which the optimization process of the settings ends at step 345. If the application is verified and trusted in step 310, the process of studying the compatibility of the application and the antivirus with various settings begins. When the application script is executed, at step 315, security operations associated with the operation or set of operations performed by the application are logged. In parallel, an application execution log is maintained. After the application script has been completed, the study is conducted for another application execution script 325. Switching the execution script, as noted earlier, is carried out by changing the application settings, launching the application user function and other operations. After the parallel operation of the antivirus and the application is analyzed (in whole or in part), priorities are determined for registered antivirus operations 330. The priority of the operation actually means how much it is necessary to leave this operation and the corresponding antivirus function to ensure a high level of security. The maximum priority corresponds to those antivirus operations that cannot be disabled even with the minimum resource capabilities of the computer and with the application fully meeting the security criteria. The minimum priority of the operation means that the corresponding function practically does not make a useful contribution to ensuring the security of the computer system when checking the operation of a trusted application. Functions consisting of operations with the lowest priority are excluded from the antivirus functionality when scanning objects of this application, but they can be reconnected if there are enough computing resources to do this. Priority other than the minimum and maximum values means the dependence of the operation and parameters of the corresponding antivirus module on the parameters of the computer system, which the configuration script will determine and use as input parameters in the future. Determining the priority of an operation can be implemented using expert systems (applying rules that directly correspond to the priority value and the operation or type of operation); the use of fuzzy logic systems, when the priority value is determined by many factors with different weighting factors and other methods of functional dependence.

The registered operations and the calculated priorities corresponding to them are translated into the settings of the security tool at step 335. Settings in many implementation options can represent files or records of various formats: configuration file, markup file, set of control commands. In the proposed implementation example, the settings are a set of instructions (script, script). This format allows you to store a large number of settings and dynamically determine the necessary setting depending on the values of the input parameters.

After the setup script was created at step 335, it is transferred first to the global database 224, then to the expert database 232, and after this script instruction, 340 are applied to the CS. At this stage, the process of optimizing antivirus settings for trusted applications ends with 345.

Figure 4 shows the security settings algorithm during the operation of the COP, depending on various factors. The security policies set by the user or administrator and applied to the CS in the existing systems are static (they do not change and do not adapt to the operation of the CS) or have a limited list of variations and a long update time (relative to the rate of change of computer status). Creating accurate (thin) settings and applying configuration scripts allows you to respond to changes in the CS and change the settings so as not to create a large computational load and constantly maintain a high level of security of the computer, data, application and network to which the CS is connected. After the necessary settings for this computer are determined, sets of instructions (scripts) are downloaded to it for setting up a security tool for each trusted and critical application installed on the computer in step 400. Next, the computing resources of the SC in step 410 are available, which are available in the current time interval, and the current application execution scenarios (settings, operation mode, user function) are determined 420. Steps 410 and 420 can produce a configuration script or other component, for example, services and the operating system, which will pass the information to the configuration instructions as an input parameter. Further, depending on the parameter values determined in the previous steps, at step 430 the settings most suitable for the current situation are applied. The operating mode of the application, the load on the computer system can change regardless of the security system. When changes to the application execution script 440 are detected or when the number of computing resources available to the security tool 450 changes, the configuration script revises and, if necessary, changes the security settings (security policy settings) in accordance with the logic that is embedded in the configuration script during its generation. At the same time, the adjustment of the security tool depending on the given attributes is shown as an example. The setup script may also vary the settings depending on the following factors: an authorized computer user, a list of running programs, the geographic location of the computer, recorded epidemics, security triggering (possibly even for another application), etc.

The following describes an example of a computer system, the architecture of which is the basis of the administration server, personal device and computer system, the elements of which are reproduced by the emulator.

Figure 5 represents an example of a general-purpose CS, a personal computer or server 20 comprising a central processor 21, a system memory 22 and a system bus 23 that contains various system components, including memory associated with the central processor 21. The system bus 23 is implemented, like any bus structure known in the art, which in turn contains a bus memory or a bus memory controller, a peripheral bus and a local bus that is capable of interacting with any other bus architecture. The system memory contains read-only memory (ROM) 24, random access memory (RAM) 25. The main input / output system (BIOS) 26 contains the basic procedures that ensure the transfer of information between the elements of the personal computer 20, for example, at the time of loading the operating system using ROM 24.

The personal computer 20 in turn contains a hard disk 27 for reading and writing data, a magnetic disk drive 28 for reading and writing to removable magnetic disks 29, and an optical drive 30 for reading and writing to removable optical disks 31, such as a CD-ROM, DVD -ROM and other optical information carriers. The hard disk 27, the magnetic disk drive 28, the optical drive 30 are connected to the system bus 23 through the interface of the hard disk 32, the interface of the magnetic disks 33 and the interface of the optical drive 34, respectively. Drives and associated computer storage media are non-volatile means of storing computer instructions, data structures, software modules and other data of a personal computer 20.

The present description discloses an implementation of a system that uses a hard disk 27, a removable magnetic disk 29, and a removable optical disk 31, but it should be understood that other types of computer storage media 56 that can store data in a form readable by a computer (solid state drives, flash memory cards, digital disks, random access memory (RAM), etc.) that are connected to the system bus 23 through the controller 55.

Computer 20 has a file system 36 where the recorded operating system 35 is stored, as well as additional software applications 37, other program modules 38, and program data 39. The user is able to enter commands and information into personal computer 20 via input devices (keyboard 40, keypad “ the mouse "42). Other input devices (not displayed) can be used: microphone, joystick, game console, scanner, etc. Such input devices are, as usual, connected to the COP 20 through a serial port 46, which in turn is connected to the system bus, but can be connected in another way, for example, using a parallel port, a game port, or a universal serial bus (USB). A monitor 47 or other type of display device is also connected to the system bus 23 via an interface such as a video adapter 48. In addition to the monitor 47, the personal computer can be equipped with other peripheral output devices (not displayed), for example, speakers, a printer, etc. .

The personal computer 20 is capable of operating in a networked environment, using a network connection with another one or more remote computers 49. The remote computer (or computers) 49 are the same personal computers or servers that have most or all of the elements mentioned above in the description creatures of the personal computer 20 of FIG. 5. Other devices, such as routers, network stations, peer-to-peer devices, or other network nodes may also be present on the computer network.

Network connections can form a local area network (LAN) 50 and a wide area network (WAN). Such networks are used in FAC, internal networks of companies and, as a rule, have access to the Internet. In LAN or WAN networks, the personal computer 20 is connected to the local area network 50 via a network adapter or network interface 51. When using the networks, the personal computer 20 may use a modem 54 or other means of providing communication with a global computer network such as the Internet. The modem 54, which is an internal or external device, is connected to the system bus 23 via the serial port 46. It should be clarified that the network connections are only exemplary and are not required to display the exact network configuration, i.e. in reality, there are other ways to establish a technical connection between one computer and another.

In accordance with the description, components, execution steps, data structure described above can be performed using various types of operating systems, computer platforms, programs.

In conclusion, it should be noted that the information provided in the description are only examples that do not limit the scope of the present invention defined by the claims.

Claims (20)

1. A method for automatically modifying a security tool, consisting of the steps in which:
- check the application for compliance with security criteria;
- if the application meets the security criteria, then the application is launched for execution in test mode;
- switch application execution scripts;
- register operations performed by the security tool during execution of application scripts, while registering operations associated with the executable application;
- determine the priorities for registered operations;
- form a set of instructions for the modification of the security tool, while the modification of the security tool ensures that the security tool performs operations depending on the priority mentioned;
- modify the security tool by executing the generated set of instructions. 2. The method according to claim 1, in which the security criteria include at least one of the following conditions: the presence of a digital signature of the application; lack of malicious objects in the application; lack of vulnerabilities in the application; compliance of the security rating with the trusted. 3. The method according to claim 1, in which the execution of the application in test mode is performed in an emulated environment. 4. The method according to claim 1, in which the execution of the application in test mode is performed using a user action simulator. 5. The method of claim 1, wherein the application execution scripts are switched by changing application settings. 6. The method according to claim 1, in which the application execution scripts are switched by calling the user functions of the application. 7. The method according to claim 1, in which the registration of operations includes intercepting calls to functions of the operating system. 8. The method according to claim 1, in which the minimum priority value corresponds to the exclusion of the operation. 9. The method according to claim 1, in which the maximum priority value corresponds to the operation at the first technical opportunity. 10. The method according to claim 1, in which the security tool is installed on a computer system other than the one where the application is running. 11. The method according to claim 1, further comprising storing a generated set of instructions that modify the security features and associated with said application for use on other computer systems. 12. A method for researching applications for automatically modifying a security tool, comprising the steps of:
- the application is launched for execution in real mode on at least one computer system;
- determine the script for the application in real mode;
- register operations performed by the security tool during execution of the application script, while registering operations associated with the executable application;
- check the application for compliance with security criteria;
- if the application meets the security criteria, then priorities are determined for registered operations;
- form a set of instructions for the modification of the security tool, while the modification of the security tool ensures that the security tool performs operations depending on the priority mentioned;
- modify the security tool by executing the generated set of instructions. 13. The method according to item 12, in which the security criteria include at least one of the following conditions: the presence of a digital signature of the application; lack of malicious objects in the application; lack of vulnerabilities in the application; compliance of the security rating with the trusted. 14. The method according to item 12, in which the execution of the application in real mode is performed on the processor and in the memory of the computer system when the user of the computer system interacts with the application. 15. The method according to item 12, in which the script execution of the application is determined, at least the application settings or called user-defined functions of the application. 16. The method according to item 12, in which the registration of operations includes intercepting calls to the functions of the operating system. 17. The method according to item 12, in which the minimum priority value corresponds to the exclusion of the operation. 18. The method according to item 12, in which the maximum priority value corresponds to the operation as soon as possible. 19. The method according to item 12, in which the security tool is installed on a computer system other than the one where the application is running. 20. The method according to p. 12, further comprising storing the generated set of instructions for modifying the security means in accordance with said application for use on other computer systems.

Images