Systems and methods for profiling client systems

• US 10,057,274 B1
• Filed: 03/31/2016
• Issued: 08/21/2018
• Est. Priority Date: 03/31/2016
• Status: Active Grant

• Current Assignee: Gen Digital Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Roundy, Kevin Alejandro, Bilge, Leylya, Gates, Christopher
• Primary Examiner(s): Hoffman, Brandon S
• Application Number:
  US15/087,623
• Time in Patent Office: 873 Days
• Field of Search: 726 1
• CPC Class Codes: G06F 16/24578 using ranking
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06Q 30/0204 Market segmentation
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 67/303 Terminal profiles

Abstract

The disclosed computer-implemented method for profiling client systems may include (1) identifying one or more administrative categories used to categorize clients according to system profiles of the clients, (2) collecting attribute information that associates one or more client attributes with the administrative category, (3) generating, based at least in part on the association between the client attribute and the administrative category, an association scoring protocol that estimates an association strength between clients and the administrative category, (4) assigning, based on the association scoring protocol, an association score to one or more clients, (5) determining, based on the association score being above a threshold, that the client should be associated with the administrative category, and (6) initiating one or more customized administrative actions for the client, based at least in part by the association of the client with the administrative category. Various other methods, systems, and computer-readable media are also disclosed.

Claims

1. A computer-implemented method for profiling client systems, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

identifying at least one administrative category used to categorize clients according to system profiles of the clients;

collecting attribute information that associates at least one client attribute with the administrative category;

generating, based at least in part on the association between the client attribute and the administrative category, an association scoring protocol that estimates an association strength between clients and the administrative category, wherein the association between the client attribute and the administrative category is based on clients previously assigned to the administrative category having the client attribute;

assigning, based on the association scoring protocol, an association score to at least one client;

determining, based on the association score being above a threshold, that the client should be associated with the administrative category; and

initiating at least one customized administrative action for the client, based at least in part by the association of the client with the administrative category.

2. The computer-implemented method of claim 1, wherein collecting attribute information that associates the client attribute with the administrative category comprises:

identifying at least one client attribute that associates clients with the administrative category;

assigning, based on the identified client attribute, at least one client to the administrative category;

identifying additional attribute information associated with the client.

3. The computer-implemented method of claim 1, wherein collecting attribute information that associates the client attribute with the administrative category comprises:

identifying at least one client attribute that associates clients with the administrative category;

identifying additional attribute information associated with the client attribute.

4. The computer-implemented method of claim 1, wherein the attribute information comprises at least one of:

at least one file present on the client;

at least one process running on the client;

at least one network connection established by the client;

data accessed by the client;

network traffic generated by the client.

5. The computer-implemented method of claim 1, wherein generating the association scoring protocol that estimates the association strength between clients and the administrative category comprises:

identifying a plurality of clients associated with the administrative category;

identifying at least one attribute of the plurality of clients that most strongly correlates with membership in the plurality of clients;

based on the strength of the correlation between the attribute and membership in the plurality of clients, estimating the association strength between the plurality of clients and the administrative category.

6. The computer-implemented method of claim 1, wherein generating the association scoring protocol that estimates the association strength between clients and the administrative category comprises:

assigning a plurality of clients with at least one common attribute to the administrative category;

identifying at least one additional attribute of at least one client in the plurality of clients;

determining a correlation strength between the additional attribute and membership in the administrative category;

based on the correlation strength between the additional attribute and membership in the administrative category, estimating the association strength between the plurality of clients and the administrative category.

7. The computer-implemented method of claim 6, further comprising identifying an additional administrative category by:

determining that the additional attribute weakly correlates with membership in the administrative category;

determining that the additional attribute strongly correlates with membership in a subset of the plurality of clients;

assigning the subset of the plurality of clients to the additional administrative category.

8. The computer-implemented method of claim 1, wherein the customized administrative action comprises at least one of:

identifying a trusted application source for the client;

identifying a trusted application update source for the client;

modifying at least one client application user interface;

assigning a security alert policy to the client;

assigning a data access policy to the client;

assigning a messaging policy to the client;

notifying an administrator of the administrative category association for the client.

9. A system for profiling client systems, the system comprising:

one or more processors; and

a non-transitory memory, the memory having stored thereon instructions that when executed by the one or more processors cause the system to;

identify at least one administrative category used to categorize clients according to system profiles of the clients;

collect attribute information that associates at least one client attribute with the administrative category;

generate, based at least in part on the association between the client attribute and the administrative category, an association scoring protocol that estimates an association strength between clients and the administrative category, wherein the association between the client attribute and the administrative category is based on clients previously assigned to the administrative category having the client attribute;

assign, based on the association scoring protocol, an association score to at least one client;

determine, based on the association score being above a threshold, that the client should be associated with the administrative category; and

perform at least one customized administrative action for the client, based at least in part by the association of the client with the administrative category.

10. The system of claim 9, wherein the instructions for collecting attribute information that associates the client with the administrative category comprises instructions for:

identifying at least one client attribute that associates clients with the administrative category;

assigning, based on the identified client attribute, at least one client to the administrative category;

identifying additional attribute information associated with the client.

11. The system of claim 9, wherein the instructions for collecting attribute information that associates the client attribute with the administrative category comprises instructions for:

identifying at least one client attribute that associates clients with the administrative category;

identifying additional attribute information associated with the client attribute.

12. The system of claim 9, wherein the attribute information comprises at least one of:

at least one file present on the client;

at least one process running on the client;

at least one network connection established by the client;

data accessed by the client;

network traffic generated by the client.

13. The system of claim 9, wherein the instructions for generating the association scoring protocol that estimates the association strength between clients and the administrative category comprises instructions for:

identifying a plurality of clients associated with the administrative category;

identifying at least one attribute of the plurality of clients that most strongly correlates with membership in the plurality of clients;

estimating the association strength between the plurality of clients and the administrative category.

14. The system of claim 9, wherein the the instructions for generating the association scoring protocol that estimates the association strength between clients and the administrative category comprises instructions for:

assigning a plurality of clients with at least one common attribute to the administrative category;

identifying at least one additional attribute at least one client in the plurality of clients;

determining a correlation strength between the additional attribute and membership in the administrative category;

estimating the association strength between the plurality of clients and the administrative category.

15. The system of claim 14, wherein the instructions for identifying an additional administrative category comprises instructions for:

determining that the additional attribute weakly correlates with membership in the administrative category;

determining that the additional attribute strongly correlates with membership in a subset of the plurality of clients;

assigning the subset of the plurality of clients to the additional administrative category.

16. The system of claim 9, wherein the customized administrative action comprises at least one of:

identifying a trusted application source for the client;

identifying a trusted application update source for the client;

modifying at least one client application user interface;

assigning a security alert policy to the client;

assigning a data access policy to the client;

assigning a messaging policy to the client;

notifying an administrator of the administrative category association for the client.

17. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

identify at least one administrative category used to categorize clients according to system profiles of the clients;

collect attribute information that associates at least one client attribute with the administrative category;

generate, based at least in part on the association between the client attribute and the administrative category, an association scoring protocol that estimates an association strength between clients and the administrative category, wherein the association between the client attribute and the administrative category is based on clients previously assigned to the administrative category having the client attribute;

assign, based on the association scoring protocol, an association score to at least one client;

determine, based on the association score being above a threshold, that the client should be associated with the administrative category; and

initiate at least one customized administrative action for the client, based at least in part by the association of the client with the administrative category.

18. The non-transitory computer-readable medium of claim 17, wherein the one or more computer-readable instructions cause the computing device to collect attribute information that associates the client with the administrative category by:

identifying at least one client attribute that associates clients with the administrative category;

assigning, based on the identified client attribute, at least one client to the administrative category;

identifying additional attribute information associated with the client.

19. The non-transitory computer-readable medium of claim 17, wherein the one or more computer-readable instructions cause the computing device to collect attribute information that associates the client attribute with the administrative category by:

identifying at least one client attribute that associates clients with the administrative category;

identifying additional attribute information associated with the client attribute.

20. The non-transitory computer-readable medium of claim 17, wherein the one or more computer-readable instructions cause the computing device to collect attribute information comprising at least one of:

at least one file present on the client;

at least one process running on the client;

at least one network connection established by the client;

data accessed by the client;

network traffic generated by the client.