# US 2024/0193291 A1 · Runtime application self-protection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2024/0193291 A1 - Document ID: US20240193291A1 - Status: Published application - Kind: A1 - Application number: 18/079,774 - Filed: 2022-12-12 - Published: 2024-06-13 - Earliest claimed: 2022-12-12 - Assignees: Oracle International Corporation - Applicants: Oracle International Corporation - Inventors: Sora BAE; Francois GAUTHIER; Rebecca O'DONOGHUE - Web page: https://patentgrep.com/patent/US20240193291A1 ## CPC - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method may include collecting, by a software agent connected to a target application, a set of observations of executing the target application while in a logging mode. The set of observations identifies instances of operations of the target application. The method may also include transmitting the set of observations to a security service, and receiving an allow list and a confidence estimator model from the security service. The security service generalizes the operations into multiple general operations in the allow list and trains the confidence estimator model based on the set of observations. The method may in addition include transitioning, by the software agent, to a blocking mode, and controlling, according to the allow list and the confidence estimator model, performance by the target application of second instances of second operations while in blocking mode. ## Claims ### Claim 1 A method comprising: collecting, by a software agent connected to a target application, a first set of observations of executing the target application while in a logging mode, wherein the first set of observations identifies a first plurality of instances of a first plurality of operations of the target application; transmitting the first set of observations to a security service; receiving an allow list and a confidence estimator model from the security service, wherein the security service generalizes the first plurality of operations into a plurality of general operations in the allow list and trains the confidence estimator model based on the first set of observations; transitioning, by the software agent, to a blocking mode; and controlling, according to the allow list and the confidence estimator model, performance by the target application of a second plurality of instances of a second plurality of operations while in blocking mode. ### Claim 2 (depends on 1) The method of claim 1, wherein controlling performance by the target application comprises: receiving a first instance of a first operation in the second plurality of operations; making a first determination that the first operation is in the allow list; generating a first confidence level for the first determination; and allowing the first operation responsive to the first determination and the first confidence level. ### Claim 3 (depends on 2) The method of claim 2, wherein controlling performance by the target application comprises: receiving a second instance of a second operation in the second plurality of operations; making a second determination that the second operation is not in the allow list; generating a second confidence level for the second determination; and allowing the second operation responsive to the second determination and the second confidence level failing to satisfy a confidence threshold. ### Claim 4 (depends on 1) The method of claim 1, further comprising: instrumenting, by the software agent during runtime, the target application to output the first plurality of instances of the first plurality of operations. ### Claim 5 (depends on 1) The method of claim 1, further comprising: transitioning, by the software agent, to an alert mode; collecting, by the software agent, a second set of observations, wherein collecting the second set of observations comprises, for each observation in the second set of observations: detecting an instance of an operation in a third plurality of operations, determining, for the instance, a security action based on whether the operation is in the allow list and the confidence estimator model, and adding, to the observation, an identifier of the operation and the security action; and reporting, by the software agent, the second set of observations to the security service. ### Claim 6 (depends on 5) The method of claim 5, wherein the security action is at least one selected from a group consisting of block and allow of the operation. ### Claim 7 (depends on 5) The method of claim 5, wherein the security action is not performed. ### Claim 8 (depends on 1) The method of claim 1, further comprising: receiving, from the software agent in the logging mode, the first set of observations of the target application; generalizing the first plurality of operations into the allow list to obtain the plurality of general operations; training the confidence estimator model using the first set of observations; transmitting the allow list and the confidence estimator model to the software agent; and transitioning the software agent to the blocking mode. ### Claim 9 (depends on 8) The method of claim 8, further comprising: presenting, in a user interface of an agent console, the first set of observations; and receiving selections in the user interface of a security action for each of at least a subset of the first set of observations, wherein the security action is at least one selected from a group consisting of block and allow of a corresponding operation in the first plurality of operations, wherein training the confidence estimator model and the allow list is further performed using the selections. ### Claim 10 (depends on 1) The method of claim 1, further comprising: transmitting, by the software agent, an agent registration, wherein the software agent is attached to a particular instance of the target application; and receiving, by the software agent, an agent identifier responsive to the agent registration, wherein the first set of observations are transmitted with the agent identifier. ### Claim 11 (depends on 1) The method of claim 1, wherein each of a plurality of instances of the target application is connected to an individual software agent of a plurality of software agents, wherein the software agent is one of the plurality of software agents. ### Claim 12 A system comprising: an agent repository for storing an allow list; at least one computer processor; a monitor of a software agent connected to a target application, the monitor executing on the at least one computer processor and configured to: collect a first set of observations of executing the target application while in a logging mode, wherein the first set of observations identifies a first plurality of instances of a first plurality of operations of the target application, and transmit the first set of observations to a security service; and configuration code of the software agent, the configuration code executing on the at least one computer processor and configured to: receive the allow list and a confidence estimator model from the security service, wherein the security service generalizes the first plurality of operations into a plurality of general operations in the allow list and trains the confidence estimator model based on the first set of observations, and transition the monitor to a blocking mode, and wherein the monitor further controls, according to the allow list and output of the confidence estimator model, performance by the target application of a second plurality of instances of a second plurality of operations while in blocking mode. ### Claim 13 (depends on 12) The system of claim 12, wherein controlling performance by the target application comprises: receiving a first instance of a first operation in the second plurality of operations; making a determination that the first operation is in the allow list; generating a confidence level for the determination; and allowing the first operation responsive to the determination and the confidence level. ### Claim 14 (depends on 12) The system of claim 12, wherein controlling performance by the target application comprises: receiving a second instance of a second operation in the second plurality of operations; making a determination that the second operation is not in the allow list; generating a confidence level for the determination; and allowing the second operation responsive to the determination and the confidence level failing to satisfy a confidence threshold. ### Claim 15 (depends on 12) The system of claim 12, further comprising: instrumenting code of the software agent, the instrumenting code executing on the at least one computer processor and configured to: instrument the target application to output the first plurality of instances of the first plurality of operations. ### Claim 16 (depends on 12) The system of claim 12, wherein the configuration code is further configured to: transition the monitor to an alert mode, wherein the monitor, in the alert mode, is configured to: collect a second set of observations, wherein collecting the second set of observations comprises, for each observation in the second set of observations: detecting an instance of an operation in a third plurality of operations, determining, for the instance, a security action based on whether the operation is in the allow list and the confidence estimator model, and adding, to the observation, an identifier of the operation and the security action; and report the second set of observations to the security service. ### Claim 17 (depends on 12) The system of claim 12, further comprising: the security service executing on the at least one processor and comprising: an agent specific compartment configured to: receive, from the software agent in the logging mode, the first set of observations of the target application, a synthesis engine configured to: generalize the first plurality of operations into the allow list to obtain the plurality of general operations, and a confidence engine configured to: train the confidence estimator model using the first set of observations. ### Claim 18 (depends on 17) The system of claim 17, further comprising: an agent console executing on the at least one processor and comprising: presenting, in a user interface, the first set of observations; and receiving selections in the user interface of a security action for each of at least a subset of the first set of operations, wherein the security action is at least one selected from a group consisting of block and allow of a corresponding operation in the first plurality of operations, wherein training the confidence estimator model and the allow list is further performed using the selections. ### Claim 19 (depends on 17) The system of claim 17, wherein the security service further comprises: an agent registry configured to: receive an agent registration, wherein the software agent is attached to a particular instance of the target application, create the agent specific compartment and an agent identifier, and respond to the software agent with the agent identifier. ### Claim 20 A method comprising: receiving, from a software agent in a logging mode, a set of observations of a target application, wherein the software agent instruments the target application, wherein the set of observations identifies a first plurality of instances of a first plurality of operations of the target application; generalizing the first plurality of operations into a plurality of general operations in an allow list; training a confidence estimator model using the set of observations; transmitting the allow list and the confidence estimator model to the software agent; and transitioning the software agent to a blocking mode, wherein the software agent controls performance of a second plurality of instances of a second plurality of operations by the target application according to the allow list and the confidence estimator model.