# US 2020/0396261 A1 · Artificial intelligence assisted rule generation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2020/0396261 A1 - Document ID: US20200396261A1 - Status: Published application - Kind: A1 - Application number: 17/006,310 - Filed: 2020-08-28 - Published: 2020-12-17 - Earliest claimed: 2018-10-09 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: AANKUR BHATIA; SRINIVAS B. TUMMALAPENTA; HUYANH D. NGO; CARLOS E. AGUILERA - Web page: https://patentgrep.com/patent/US20200396261A1 ## CPC - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - G06F 40/30: Semantic analysis - G06N 3/042: Knowledge-based neural networks; Logical representations of neural networks - G06N 3/044: Recurrent networks, e.g. Hopfield networks - G06N 3/0442: characterised by memory or gating, e.g. long short-term memory [LSTM] or gated recurrent units [GRU] - G06N 3/08: Learning methods - G06N 3/09: Supervised learning - G06N 5/025: Extracting rules from data - G06N 5/027: {Frames} - G06N 20/10: using kernel methods, e.g. support vector machines [SVM] - G06N 20/20: Ensemble learning - H04L 63/1433: {Vulnerability analysis} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A method assigns a particular rule for a previous client to a new client for use in executing a security feature on a computer system used by the new client. One or more processors match a new client profile for the new client to a previous client profile for the previous client. The new client profile is based on types of one or more client assets of the new client and an intrusion detection alert history of the new client. The processor(s) assign the particular rule for the previous client to the new client based on the new client profile matching the previous client profile. The processor(s) receive information indicating that a violation of the particular rule has occurred, and execute a security feature of the computer system used by the new client in order to resolve the violation of the particular rule. ## Claims ### Claim 1 A method comprising: matching, by one or more processors and within a predefined range, a new client profile for a new client to a previous client profile for a previous client, wherein the new client profile is based on types of one or more client assets of the new client and an intrusion detection alert history of the new client; assigning, by the one or more processors, a particular rule for the previous client to the new client based on the new client profile matching the previous client profile within the predefined range; receiving, by the one or more processors, information indicating that a violation of the particular rule has occurred; and in response to the particular rule being violated, executing, by the one or more processors, a security feature of a computer system of the new client in order to resolve the violation of the particular rule. ### Claim 2 (depends on 1) The method of claim 1, further comprising: testing, by the one or more processors, the particular rule against the intrusion detection alert history in order to determine whether implementing the particular rule is effective in identifying security intrusions against the previous client. ### Claim 3 (depends on 1) The method of claim 1, wherein the previous client profile is for a plurality of client profiles for a plurality of previous clients, and wherein the method further comprises: inputting, by the one or more processors, the plurality of client profiles into an artificial intelligence (AI) system; vectoring, by the one or more processors, the particular rule to create a vectorized rule; and testing, by the one or more processors, the particular rule by inputting the vectorized rule into the AI system in order to test the particular rule against the intrusion detection alert history of the plurality of previous clients. ### Claim 4 (depends on 3) The method of claim 3, wherein the AI system develops the particular rule, wherein the particular rule includes alerts for respective rules, and wherein the AI system transmits the particular rule to security system components for the computer system. ### Claim 5 (depends on 1) The method of claim 1, further comprising: applying, by the one or more processors, natural language processing (NLP) to determine a similarity between environments of the new client and the previous client; and matching, by the one or more processors, the new client profile to the previous client profile based on the similarity between the environments of the new client and the previous client. ### Claim 6 (depends on 1) The method of claim 1, further comprising: installing, by the one or more processors, the particular rule into an intrusion detection system. ### Claim 7 (depends on 1) The method of claim 1, wherein the violation of the particular rule occurs in the new client. ### Claim 8 (depends on 1) The method of claim 1, wherein the violation of the particular rule occurs in the previous client. ### Claim 9 A computer program product comprising a non-transitory computer readable storage medium having program code embodied therewith, wherein the program code is readable and executable by a processor to perform a method comprising: matching, within a predefined range, a new client profile for a new client to a previous client profile for a previous client, wherein the new client profile is based on types of one or more client assets of the new client and an intrusion detection alert history of the new client; assigning a particular rule for the previous client to the new client based on the new client profile matching the previous client profile within the predefined range; receiving information indicating that a violation of the particular rule has occurred; and in response to the particular rule being violated, executing a security feature of a computer system of the new client in order to resolve the violation of the particular rule. ### Claim 10 (depends on 9) The computer program product of claim 9, wherein the method further comprises: testing the particular rule against the intrusion detection alert history in order to determine whether implementing the particular rule is effective in identifying security intrusions against the previous client. ### Claim 11 (depends on 9) The computer program product of claim 9, wherein the previous client profile is for a plurality of client profiles for a plurality of previous clients, and wherein the method further comprises: inputting the plurality of client profiles into an artificial intelligence (AI) system, wherein the AI system develops the particular rule, and wherein the particular rule includes alerts for respective rules; vectoring the particular rule to create a vectorized rule; testing the particular rule by inputting the vectorized rule into the AI system in order to test the particular rule against the intrusion detection alert history of the plurality of previous clients; and transmitting, by the AI system, the particular rule to security system components for the computer system. ### Claim 12 (depends on 9) The computer program product of claim 9, wherein the method further comprises: installing the particular rule into an intrusion detection system. ### Claim 13 (depends on 9) The computer program product of claim 9, wherein the program code is provided as a service in a cloud environment. ### Claim 14 A computer system comprising: one or more processors; one or more computer readable memories; and one or more computer readable non-transitory storage mediums having program instructions stored thereon for execution by at least one of the one or more processors via at least one of the one or more computer readable memories, the stored program instructions executed on said at least one of the one or more processors to perform a method comprising: matching, within a predefined range, a new client profile for a new client to a previous client profile for a previous client, wherein the new client profile is based on types of one or more client assets of the new client and an intrusion detection alert history of the new client; assigning a particular rule for the previous client to the new client based on the new client profile matching the previous client profile within the predefined range; receiving information indicating that a violation of the particular rule has occurred; and in response to the particular rule being violated, executing a security feature of a computer system of the new client in order to resolve the violation of the particular rule. ### Claim 15 (depends on 14) The computer system of claim 14, wherein the method further comprises: testing the particular rule against the intrusion detection alert history in order to determine whether implementing the particular rule is effective in identifying security intrusions against the previous client. ### Claim 16 (depends on 14) The computer system of claim 14, wherein the previous client profile is for a plurality of client profiles for a plurality of previous clients, and wherein the method further comprises: inputting the plurality of client profiles into an artificial intelligence (AI) system; vectoring the particular rule to create a vectorized rule; and testing the particular rule by inputting the vectorized rule into the AI system in order to test the particular rule against the intrusion detection alert history of the plurality of previous clients. ### Claim 17 (depends on 16) The computer system of claim 16, wherein the AI system develops the particular rule, wherein the particular rule includes alerts for respective rules, and wherein the AI system transmits the particular rule to security system components for the computer system. ### Claim 18 (depends on 14) The computer system of claim 14, wherein the method further comprises: applying natural language processing (NLP) to determine a similarity between environments of the new client and the previous client; and matching the new client profile to the previous client profile based on the similarity between the environments of the new client and the previous client. ### Claim 19 (depends on 14) The computer system of claim 14, wherein the method further comprises: installing the particular rule into an intrusion detection system. ### Claim 20 (depends on 14) The computer system of claim 14, wherein the program instructions are provided as a service in a cloud environment.