# US 10,122,762 B2 · Classification of security rules > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,122,762 B2 - Document ID: US10122762B2 - Status: Granted - Kind: B2 - Application number: 15/182,827 - Filed: 2016-06-15 - Published: 2017-12-21 - Granted: 2018-11-06 - Earliest claimed: 2016-06-15 - Assignees: Empow Cyber Security Ltd. - Applicants: Empow Cyber Security Ltd. - Inventors: Avi Chesla; Shlomi Medalion - Web page: https://patentgrep.com/patent/US10122762B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 16/24575: {using context} - G06F 16/285: {Clustering or classification} - G06F 16/9535: Search customisation based on user profiles and personalisation - G06F 21/554: {involving event detection and direct action} - G06F 21/604: {Tools and structures for managing or administering access control systems} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/105: {Multiple levels of security} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system and method for classifying security rules of a plurality of different security products into a security decision engine in a service. The method comprises receiving at least one security rule from at least one attack database of a security product of the plurality of different security products; normalizing each of the at least one security rule; generating a vector for each of the least one normalized security rule, wherein each vector is generated based on a set of terms indicative of a cyber-solution; mapping each of the generated vector to a security service, wherein the security service represents a cyber-solution category, wherein the mapping is performed using a classification model; and associating each of the respective security rule with the security service, when an evaluation threshold is met. ## Claims ### Claim 1 A method for using a plurality of different security products in a computer network by classifying security rules of the security products into a security decision engine in a service, comprising: receiving at least one security rule from at least one attack database of each of at least two different ones of the security products; normalizing each of the received security rules; generating a vector for each of the least one normalized security rule, wherein each vector is generated based on a set of terms indicative of a cyber-solution; mapping each of the generated vectors to one of a plurality of security services, wherein each of the security services represents a cyber-solution category, wherein the mapping is performed using a classification model; and associating each of the security rules with the respective security service to which its corresponding vector was mapped, when an evaluation threshold is met. ### Claim 2 (depends on 1) The method of claim 1, further comprising: associating each of the security rules with a security engine operable by the security service. ### Claim 3 (depends on 2) The method of claim 2, further comprising generating by the security engine a real-time event upon matching of the respective associated security rule to a network attribute. ### Claim 4 (depends on 1) The method of claim 1, wherein each of the plurality of different security products belongs to the same cyber-solution category. ### Claim 5 (depends on 1) The method of claim 1, wherein normalizing each of the received security rules further comprises: converting all letters in fields of each of the received security rules into a single representation; filtering out none-indicative stop-words from each of the received security rules; and stemming words having the same root. ### Claim 6 (depends on 5) The method of claim 5, further comprising: retrieving only a set of most-indicative fields of each of the received security rules. ### Claim 7 (depends on 1) The method of claim 1, wherein the classification model is developed in an off-line process. ### Claim 8 (depends on 2) The method of claim 2, wherein the associating of security rules into the security service and security engine is performed in real-time. ### Claim 9 (depends on 8) The method of claim 8, wherein generating the vector for each of the received security rules further comprises: transforming a normalized string into a quantitative vector of values, wherein each vector is generated based on a set of terms indicative of a type of threat. ### Claim 10 (depends on 9) The method of claim 9, wherein the values are determined based on an appearance level of each indicative terms in a respective security rule. ### Claim 11 (depends on 2) The method of claim 2, wherein each classification model relates to a single security engine. ### Claim 12 (depends on 1) The method of claim 1, wherein the mapping each of the generated vectors further comprises: providing a prediction of how a security rule is mapped to a security engine. ### Claim 13 (depends on 1) The method of claim 1, wherein security engine is configured to generated events based on the security rules as associated. ### Claim 14 A system for using a plurality of different security products in a computer network by classifying security rules of the security products into a security decision engine in a service, comprising: a processing system; a memory communicatively connected to the processing system, wherein the memory contains instructions that, when executed by the processing element, configure the processing system to: receive at least one security rule from at least one attack database of each of at least two different ones of the security products; normalize each of the at least one security rule; generate a vector for each of the least one normalized security rule, wherein each vector is generated based on a set of terms indicative of a cyber-solution; map each of the generated vectors to one of a plurality of security services, wherein each of the security services represents a cyber-solution category, wherein the mapping is performed using a classification model; and associate each of the security rules with the respective security service to which its corresponding vector was mapped, when an evaluation threshold is met. ### Claim 15 (depends on 14) The system of claim 14, wherein the system is further configured to: associate each of the security rules with a security engine operable by the security service. ### Claim 16 (depends on 15) The system of claim 15, wherein the security engine is configured to generate a real-time event upon matching of the respective associated security rule to a network attribute. ### Claim 17 (depends on 14) The system of claim 14, wherein each of the plurality of different security products belongs to the same cyber-solution category. ### Claim 18 (depends on 14) The system of claim 14, wherein the system is further configured to: convert all letters in fields of each of the received security rules into a single representation; filter out none-indicative stop-words from each of the received security rules; and stem words having the same root. ### Claim 19 (depends on 14) The system of claim 14, wherein the system is further configured to: retrieve only a set of most-indicative fields of each of the received security rules. ### Claim 20 (depends on 14) The system of claim 14, wherein the classification model is developed in an off-line process. ### Claim 21 (depends on 15) The system of claim 15, wherein the associating of security rules into the security service and security engine is performed in real-time. ### Claim 22 (depends on 21) The system of claim 21, wherein the system is further configured to: transform a normalized string into a quantitative vector of values, wherein each vector is generated based on a set of terms indicative of a type of threat. ### Claim 23 (depends on 22) The system of claim 22, wherein the values are determined based on an appearance level of each indicative terms in a respective security rule. ### Claim 24 (depends on 15) The system of claim 15, wherein each classification model relates to a single security engine. ### Claim 25 (depends on 14) The system of claim 14, wherein the system is further configured to: provide a prediction of how a security rule is mapped to a security engine. ### Claim 26 (depends on 14) The system of claim 14, wherein security engine is configured to generated events based on the security rules as associated. ### Claim 27 A non-transitory computer readable medium having stored thereon instructions for causing one or more processing units to execute a process for using a plurality of different security products in a computer network by classifying security rules of the security products into a security decision engine in a service comprising the steps of: receiving at least one security rule from at least one attack database of each of at least two different ones of the security products; normalizing each of the received security rules; generating a vector for each of the least one normalized security rule, wherein each vector is generated based on a set of terms indicative of a cyber-solution; mapping each of the generated vectors to one of a plurality of security services, wherein each of the security services represents a cyber-solution category, wherein the mapping is performed using a classification model; and associating each of the security rules with the respective security service to which its corresponding vector was mapped, when an evaluation threshold is met.