System and method for dynamically allocating computing resources for processing security information

• US 8,214,905 B1
• Filed: 12/21/2011
• Issued: 07/03/2012
• Est. Priority Date: 12/21/2011
• Status: Active Grant

• Current Assignee: Kaspersky Lab ZAO
• Original Assignee: Kaspersky Lab ZAO
• Inventors: Doukhvalov, Andrey P., Tikhomirov, Anton V.
• Primary Examiner(s): Cervetti, David Garcia
• Application Number:
  US13/333,369
• Time in Patent Office: 195 Days
• Field of Search: 726/22, 726/23, 726/24, 726/25
• US Class Current: 726/24
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Disclosed are systems, methods and computer program products for dynamically allocating computing resources for processing security information. In one example, the system receives from an antivirus application deployed on a user'"'"'s computer information about user'"'"'s actions related to the security of said computer. The system analyzes the received information to determine user'"'"'s level of expertise in the field of computer security. The system then classifies the user into one of two or more different roles based on the determined level of expertise. The system automatically selects, based on the user'"'"'s role, configuration setting of the antivirus application for collecting information about security threats detected by the user. The system also automatically allocates and configures, based on the user'"'"'s role, computing resources and services for processing information collected by the antivirus application deployed on the user'"'"'s computer about security threats detected by the user.

Claims

1. A computer-implemented method for dynamically allocating computing resources for processing security information, the method comprising:

receiving from an antivirus application deployed on a user'"'"'s computer information about user'"'"'s actions related to the security of said computer;

analyzing the user'"'"'s actions related to the security of said computer to determine user'"'"'s level of expertise in the field of computer security;

classifying the user into one of two or more different roles based on the user'"'"'s level of expertise in the field of computer security;

automatically selecting, based on the user'"'"'s role, configuration setting of the antivirus application for collecting information about security threats detected by the user, wherein more information about security threats detected by a user is collected from a user with higher level of expertise in the field of computer security than a user with lower level of expertise in the field of computer security;

automatically allocating and configuring, based on the user'"'"'s role, computing resources and services for processing information collected by the antivirus application deployed on the user'"'"'s computer about security threats detected by the user, wherein more computing resources and services are allocated to processing information from a user with higher level of expertise in the field of computer security than to a user with lower level of expertise.

2. The method of claim 1 further comprising:

selecting, based on the user'"'"'s role, user interface settings for the antivirus application, wherein user interface settings for a user with higher level of expertise in the field of computer security provide greater level of control over operation of the antivirus application than user interface settings for a user with lower level of expertise in the field of computer security.

3. The method of claim 1 further comprising:

allocating, based on the user'"'"'s role, network resources for collecting information from the antivirus application, wherein more network resource are allocated to a user with higher level of expertise in the field of computer security than to a user with lower level of expertise.

4. The method of claim 1 further comprising:

assigning, based on the user'"'"'s role, a priority to processing information collected by the antivirus application about security threats detected by the user, wherein higher processing priority is assigned to information collected from a user with higher level of expertise in the field of computer security than to a user with lower level of expertise.

5. The method of claim 1, wherein the user'"'"'s level of expertise in the field of computer security is based on one or more of:

a total number of computer threats detected by said user;

a number of unique computer threats detected by said user;

a level of user proficiency with the antivirus software;

a frequency of infections of the computer of said user; and

information about programs installed on the user'"'"'s computer and the user'"'"'s usage of said programs.

6. The method of claim 1, wherein classifying a user in to one of two or more roles includes classifying the user using fuzzy logic rules.

7. A computer-based system for dynamically allocating computing resources for processing security information, the system comprising:

a processor configured to;

receive from an antivirus application deployed on a user'"'"'s computer information about user'"'"'s actions related to the security of said computer;

analyze the user'"'"'s actions related to the security of said computer to determine user'"'"'s level of expertise in the field of computer security;

classify the user into one of two or more different roles based on the user'"'"'s level of expertise in the field of computer security;

automatically select, based on the user'"'"'s role, configuration setting of the antivirus application for collecting information about security threats detected by the user, wherein more information about security threats detected by a user is collected from a user with higher level of expertise in the field of computer security than a user with lower level of expertise in the field of computer security;

automatically allocate and configure, based on the user'"'"'s role, computing resources and services for processing information collected by the antivirus application deployed on the user'"'"'s computer about security threats detected by the user, wherein more computing resources and services are allocated to processing information from a user with higher level of expertise in the field of computer security than to a user with lower level of expertise.

8. The system of claim 7, wherein the processor is further configured to:

select, based on the user'"'"'s role, user interface settings for the antivirus application, wherein user interface settings for a user with higher level of expertise in the field of computer security provide greater level of control over operation of the antivirus application than user interface settings for a user with lower level of expertise.

9. The system of claim 7, wherein the processor is further configured to:

allocate, based on the user'"'"'s role, network resources for collecting information from the antivirus application, wherein more network resource are allocated to a user with higher level of expertise in the field of computer security than to a user with lower level of expertise.

10. The system of claim 7, wherein the processor is further configured to:

assign, based on the user'"'"'s role, a priority to processing information collected by the antivirus application about security threats detected by the user, wherein higher processing priority is assigned to information collected from a user with higher level of expertise in the field of computer security than to a user with lower level of expertise.

11. The system of claim 7, wherein the user'"'"'s level of expertise in the field of computer security is based on one or more of:

a total number of computer threats detected by said user;

a number of unique computer threats detected by said user;

a level of user proficiency with the antivirus software;

a frequency of infections of the computer of said user; and

information about programs installed on the user'"'"'s computer and the user'"'"'s usage of said programs.

12. The system of claim 7, wherein to classify a user in to one of two or more roles the processor is further configured to classify the user using fuzzy logic rules.

13. A computer program product embedded in a non-transitory computer-readable storage medium, the computer-readable storage medium comprising computer-executable instructions for dynamically allocating computing resources for processing security information, the medium comprises instructions for:

receiving from an antivirus application deployed on a user'"'"'s computer information about user'"'"'s actions related to the security of said computer;

analyzing the user'"'"'s actions related to the security of said computer to determine user'"'"'s level of expertise in the field of computer security;

classifying the user into one of two or more different roles based on the user'"'"'s level of expertise in the field of computer security;

automatically selecting, based on the user'"'"'s role, configuration setting of the antivirus application for collecting information about security threats detected by the user, wherein more information about security threats detected by a user is collected from a user with higher level of expertise in the field of computer security than a user with lower level of expertise in the field of computer security;

automatically allocating and configuring, based on the user'"'"'s role, computing resources and services for processing information collected by the antivirus application deployed on the user'"'"'s computer about security threats detected by the user, wherein more computing resources and services are allocated to processing information from a user with higher level of expertise in the field of computer security than to a user with lower level of expertise.

14. The product of claim 13 further comprises instructions for:

selecting, based on the user'"'"'s role, user interface settings for the antivirus application, wherein user interface settings for a user with higher level of expertise in the field of computer security provide greater level of control over operation of the antivirus application than user interface settings for a user with lower level of expertise in the field of computer security.

15. The product of claim 13 further comprises instructions for:

allocating, based on the user'"'"'s role, network resources for collecting information from the antivirus application, wherein more network resource are allocated to a user with higher level of expertise in the field of computer security than to a user with lower level of expertise.

16. The product of claim 13 further comprises instructions for:

assigning, based on the user'"'"'s role, a priority to processing information collected by the antivirus application about security threats detected by the user, wherein higher processing priority is assigned to information collected from a user with higher level of expertise in the field of computer security than to a user with lower level of expertise.

17. The product of claim 13, wherein the user'"'"'s level of expertise in the field of computer security is based on one or more of:

a total number of computer threats detected by said user;

a number of unique computer threats detected by said user;

a level of user proficiency with the antivirus software;

a frequency of infections of the computer of said user; and

information about programs installed on the user'"'"'s computer and the user'"'"'s usage of said programs.

18. The product of claim 13, wherein instructions for classifying a user in to one of two or more roles include instructions for classifying the user using fuzzy logic rules.