Generation of application allowed lists for machines

A computing system generating an allowed list of applications for machines, the computing system comprising:

• a computer-readable storage medium, which does not include a transitory propagating signal, storing computer-executable instructions that when executed control the computing system to:
• collect from each machine an execution log that indicates applications that were executed by the machine;
• generate for each machine an executed-application set that indicates executed applications that were executed by the machine based on analysis of the execution log for the machine;
• divide the executed-application set for each machine into a training set and a testing set;
• generate clusters of the machines based on similarity among the executed-application sets of the machines such that machines with similar executed-application sets are in the same cluster;
• create for each cluster an allowed list of applications for the cluster that includes the applications in the training sets of the machines of the cluster, the allowed list for a cluster being a set of executed applications that is an intersection of the executed-application sets of the machines in the cluster;
• test the allowed list for a cluster to determine whether an executed application in the testing set is not in the allowed list;
• for a machine, generate an enforcement log of allowed applications whose execution was allowed and blocked applications whose execution was blocked;
• and
• analyze the enforcement log to determine whether to adjust the allowed list for a cluster;
• and
• distribute the allowed list for each cluster to the machines in that cluster so that each machine of a cluster can enforce the allowed list of the cluster, the machines of a cluster allow execution of only the applications in the allowed list and block execution of all other applications;
• and
• a processor that executes the computer-executable instructions stored in the computer-readable storage medium.

A computer-readable storage medium, which does not include a transitory propagating signal, storing computer-executable instructions to control a computing system to generate an allowed list of applications for machines, the computer-executable instructions comprising instructions that control the computing system to:

• generate clusters of the machines based on similarity among the sets of applications executed by the machines such that machines with similar sets of applications are in the same cluster;
• divide the executed-application set for each machine into a training set and a testing set;
• create an allowed list of applications for each cluster that includes the applications in the training sets of the machines of the cluster and is an intersection of the sets of applications executed by the machines in the cluster;
• test the allowed list for a cluster to determine whether an executed application in the testing set is not in the allowed list;
• for a machine, generate an enforcement log of allowed applications whose execution was allowed and blocked applications whose execution was blocked;
• and
• analyze the enforcement log to determine whether to adjust the allowed list for a cluster;
• and
• direct distribution of the allowed list for each cluster to the machines in that cluster so that each machine executes only those application that are in the allowed list that is distributed to it.