Reviewing effectiveness of communication rules system

• US 20070150253A1
• Filed: 12/28/2005
• Published: 06/28/2007
• Est. Priority Date: 12/28/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Pearson, Malcolm, Thomas, Shawn, Dougherty, Jesse
• Granted Patent: US 7,734,754 B2
• Time in Patent Office: Days
• US Class Current: 703/22
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/234 for tracking messages
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method for reviewing effectiveness of a rules system applying one or more rules to communication traffic of a group of users. The method analyzes a log containing one or more communications reviewed by the rules system to determine if the communications in the log conforms to the communications policy. The method also identifies one or more of the rules of the rules system violated by the communications when the analyzing the log determines that at least one of the communications in the log does not conform to the communications policy. Other methods determine the effectiveness of planned modifications to a rules system.

Claims

1. A method for reviewing effectiveness of a rules system, said rules system applying one or more rules to communication traffic of a group of users, said rules being adapted for conforming the communication traffic to a communications policy, said method comprising:

analyzing a log containing one or more communications reviewed by the rules system to determine if the communications in the log conforms to the communications policy; and

identifying one or more of the rules of the rules system violated by the communications when the analyzing the log determines that at least one of the communications in the log does not conform to the communications policy.

2. A method as set forth in claim 1 further comprising analyzing the violated rules to determine a basis for why the violated rules were not effective in conforming the communications in the log to the communications policy;

and

determining modifications to the rules applied by the rules system facilitating conformance of the communication traffic to the communications policy.

3. A method as set forth in claim 2 wherein said determining modifications comprises at least one of adding an additional rule, deleting a rule, and modifying an existing rule.

4. A method as set forth in claim 2 further comprising:

applying the determined modifications to the rules system to create a modified rules system;

testing the modified rules system on the communications in the log; and

determining effectiveness of the modified rules system to conform the test communications to the communication policy.

5. A method as set forth in claim 4 further comprising

identifying one or more of the rules of the modified rules system violated during the testing when the determining effectiveness of the modified rules system determines that at least one of the test communications do not conform to the communications policy.

6. A method as set forth in claim 1 further comprising collecting the log from the communication traffic of a group of users subject to the communications policy.

7. A method as set forth in claim 6 wherein said collecting the log from the communication traffic comprises collecting at least one of an electronic-mail communication log, an instant messaging communication log, and a file transfer protocol communication log.

8. A method as set forth in claim 1 further comprising calculating an aggregation risk metric based upon the identified violated rules for determining a risk associated with the identified violated rules.

9. A method for determining effectiveness of planned modifications to a rules system, said rules system applying one or more rules to communication traffic of a group of users, said rules being adapted for conforming the communication traffic to a communications policy, said method comprising:

determining modifications to the rules applied by the rules system facilitating conformance of the communication traffic to the communications policy;

applying said determined modifications to the rules system to create a modified rules system;

testing the modified rules system on at least a portion of the communication traffic previously reviewed by an unmodified rules system; and

determining effectiveness of the modified rules system to conform the communication traffic to the communications policy based upon the testing.

10. A method as set forth in claim 9 wherein said determining effectiveness of the modified rules system comprises comparing results of the testing of the modified rules system to results of reviewing the communication traffic by the unmodified rules system.

11. A method as set forth in claim 9 wherein said determining effectiveness of the modified rules system comprises selecting a particular user, and at least one of determining one or more allowable communications of said selected user under the modified rules system, and determining one or more prohibited communications of said user under the modified rules system.

12. A method as set forth in claim 9 wherein said determining comprises

selecting a particular communication of the communication traffic and

determining at least one of if the selected communication is prohibited under the modified rules system and if the selected communication is allowable under the modified rules system.

13. A method as set forth in claim 12 further comprising

identifying at least one of the rules of the modified rules system prohibiting the selected communication when said determining determines that the selected communication is prohibited under the modified rules system, and

identifying the at least one of the rules of the modified rules system allowing the selected communication when said determining determines that the selected communication is allowable under the modified rules system.

14. A method as set forth in claim 13 further comprising

determining modifications to the rules applied by the modified rules system facilitating allowance of the selected communication when said determining determines that the selected communication is prohibited under the modified rules system, and

determining modifications to the rules applied by the modified rules system facilitating prohibition of the selected communication when said determining determines that the selected communication is allowable under the modified rules system.

15. A method as set forth in claim 9 further comprising identifying one or more of the rules of the modified rules system violated by the communication traffic when the determining effectiveness of the modified rules system determines that the communication traffic does not conform to the communications policy;

analyzing the violated rules to determine a basis for why the violated rules were not effective in conforming the communication traffic to the communications policy; and

determining further modifications to the modified rules applied by the modified rules system facilitating conformance of the communication traffic to the communications policy.

16. A method as set forth in claim 9 further comprising collecting a log containing at least a portion of the communication traffic of a group of users subject to the communications policy and wherein determining the effectiveness of the modified rules system comprises applying both the unmodified rules system and the modified rules system to the log and comparing the results.

17. A method as set forth in claim 16 wherein said collecting the log from the communication traffic comprises collecting at least one of an electronic mail communication log, an instant messaging communication log, and a file transfer protocol communication log.

18. A control system for reviewing effectiveness of a rules system, said rules system applying one or more rules to communication traffic of a group of users, said rules being adapted for conforming the communication traffic to a communications policy, said control system comprising:

a rules store containing a copy of one or more rules applied by the rules system;

a communications store for collecting one or more communications reviewed by the rules system;

a processor adapted for accessing the rules store and the communications store for

analyzing the communications of the communications store to determine if the communication traffic reviewed by the rules system conform to the communications policy and

identifying one or more of the rules of the rules system violated by the communication traffic when the analyzing the communications determines that at least one of the communications in the communications store does not conform to the communications policy.

19. A control system as set forth in claim 18 further comprising a user interface for communicating the identified rules of the rules system violated by the communication traffic when the analyzing determines that at least one of the communications in the communications store does not conform to the communications policy.

20. A control system as set forth in claim 18 wherein said processor is further adapted for analyzing the violated rules to determine a basis for why the violated rules were not effective in conforming the communication traffic to the communications policy;

and

determining modifications to the rules applied by the rules system facilitating conformance of the communication traffic to the communications policy.