Method and system for labeling object and generating security policy of operating system

A system of labeling object of operating system adapted to a target object of a target operating system, wherein the target object has a target attribute and the system comprises:

• a non-transitory machine readable storage medium storing a plurality of instructions;
• and
• at least one processing device electrically connecting to the non-transitory machine readable storage medium, wherein said at least one processing device performs the plurality of instructions and triggers a plurality of operations, and the plurality of operations comprises:
• generating a default label by a labeling tool according to the target attribute;
• obtaining a reference object of a reference operating system, wherein the reference object has a reference attribute and a reference label;
• comparing whether the target attribute and the reference attribute are identical and generating a comparison result;
• and
• labeling the target object with the default label, the reference label, or one of a plurality of candidate labels according to the comparison result and a type of the target object;
• wherein labeling the target object with the default label, the reference label, or said one of the plurality of candidate labels according to the comparison result and the type of the target object comprises:
• labeling the target object with the reference label when the comparison result shows that the target attribute and the reference attribute are identical;
• determining whether the type of the target object is program when the comparison result shows that the target attribute and the reference attribute are different;
• labeling the target object with the default label when the type of the target object is not program;
• and
• performing an analysis procedure to generate the plurality of candidate labels when the type of the target object is program, and selecting said one of the plurality of candidate labels according to an accessed number corresponding to each of the plurality of candidate labels to label the target object;
• wherein the target object is a first target object, the default label is a first default label, the target operating system further comprises a plurality of second target objects, and
• before performing the analysis procedure, the method further comprises:
• labeling the plurality of second target objects with a plurality of second default labels respectively by the labeling tool;
• analyzing a plurality of behavior data of the plurality of second target objects respectively;
• and
• establishing a behavior database according to a plurality of file names of the plurality of second target objects, the plurality of second default labels and the plurality of behavior data;
• and
• the analysis procedure comprises a static stage and a dynamic stage, wherein
• the static stage comprises:
• generating a first candidate label according to a file name of the target object;
• and
• generating a second candidate label according to a target behavior and a target context of the target object;
• and
• the dynamic stage comprises:
• generating a third candidate label according to the target object and a testing script;
• wherein generating the second candidate label according to the target behavior and the target context of the target object comprises:
• obtaining a plurality of entries from the behavior database according to the target behavior, wherein the behavior data of each of the plurality of entries is identical to the target behavior;
• extracting at least one keyword from the target context according to the plurality of second default labels of the plurality of entries, wherein said at least one keyword is identical to one of the plurality of second default labels of the plurality of entries;
• and
• selecting at least one of the plurality of second default labels to be served as the second candidate label according to said at least one keyword.

A system for generating security policy of operating system adapted a plurality of target objects of a target operating system, wherein each of the target object has a target attribute, and the system comprises:

• a non-transitory machine readable storage medium storing a plurality of instructions;
• and
• at least one processing device electrically connecting to the non-transitory machine readable storage medium, wherein said at least one processing device performs the plurality of instructions and triggers a plurality of operations, and the plurality of operations comprises:
• generating a default label by a labeling tool according to the target attribute;
• obtaining a reference object of a reference operating system, wherein the reference object has a reference attribute and a reference label;
• comparing whether the target attribute and the reference attribute are identical and generating a comparison result;
• labeling each of the plurality of target objects with the default label, the reference label, or one of a plurality of candidate labels according to the comparison result and a type of the target object;
• performing a booting testing script by the target operating system to generate a plurality of system audit messages;
• and
• converting the plurality of system audit messages to a plurality of rules according to a policy generator and collecting the plurality of rules to form a security policy;
• wherein labeling the target object with the default label, the reference label, or said one of the plurality of candidate labels according to the comparison result and the type of the target object comprises:
• labeling the target object with the reference label when the comparison result shows that the target attribute and the reference attribute are identical;
• determining whether the type of the target object is program when the comparison result shows that the target attribute and the reference attribute are different;
• labeling the target object with the default label when the type of the target object is not program;
• and
• performing an analysis procedure to generate the plurality of candidate labels when the type of the target object is program, and selecting said one of the plurality of candidate labels according to an accessed number corresponding to each of the plurality of candidate labels to label the target object;
• wherein the target object is a first target object, the default label is a first default label, the target operating system further comprises a plurality of second target objects, and
• before performing the analysis procedure, the method further comprises:
• labeling the plurality of second target objects with a plurality of second default labels respectively by the labeling tool;
• analyzing a plurality of behavior data of the plurality of second target objects respectively;
• and
• establishing a behavior database according to a plurality of file names of the plurality of second target objects, the plurality of second default labels and the plurality of behavior data;
• and
• the analysis procedure comprises a static stage and a dynamic stage, wherein
• the static stage comprises:
• generating a first candidate label according to a file name of the target object;
• and
• generating a second candidate label according to a target behavior and a target context of the target object;
• and
• the dynamic stage comprises:
• generating a third candidate label according to the target object and a testing script;
• wherein generating the second candidate label according to the target behavior and the target context of the target object comprises:
• obtaining a plurality of entries from the behavior database according to the target behavior, wherein the behavior data of each of the plurality of entries is identical to the target behavior;
• extracting at least one keyword from the target context according to the plurality of second default labels of the plurality of entries, wherein said at least one keyword is identical to one of the plurality of second default labels of the plurality of entries;
• and
• selecting at least one of the plurality of second default labels to be served as the second candidate label according to said at least one keyword.