Automatic categorization of IDPS signatures from multiple different IDPS systems

A computer system, comprising:

• one or more memories storing computer-readable code;
• and
• one or more processors, wherein the one or more processors, in response to executing the computer-readable code, cause the computer system to perform operations comprising the following:
• accessing source and target signatures, wherein the source and target signatures indicate patterns that comprise a plurality of descriptive elements having information describing different aspects of a corresponding signature;
• creating a set of similarity measures of the source and target signatures, wherein the source signatures come from a source intrusion and detection system and the target signatures come from a different target intrusion and detection system, wherein the source signatures and the target signatures correspond to known threats to resources in a corresponding computer environment of their respective different source or target intrusion and detection system, and wherein the source signatures and target signatures have different sets of descriptive elements;
• integrating the set of similarity measures to generate an overall similarity metric;
• using the overall similarity metric to find appropriate categories in the target signatures into which the source signatures should be placed;
• placing the source signatures into the appropriate categories to create a mapping from the source signatures to the target signatures, the mapping being from source signatures used by the source intrusion and detection system to target signatures used by the target intrusion and detection system;
• and
• sending the mapping to the target intrusion and detection system to determine whether a threat has occurred to the resources in the computer environment for the target intrusion and detection system.

A method, comprising:

• receiving in a target intrusion and detection system, a mapping from source to target signatures, wherein the source signatures came from a source intrusion and detection system and the target signatures came from the target intrusion and detection system and the source and target intrusion and detection systems are different, wherein the source and target signatures indicate patterns that correspond to known threats to resources in a corresponding computer environment of their respective different source or target intrusion and detection system, and wherein the source signatures and target signatures had different sets of descriptive elements;
• converting, by the target intrusion and detection system, from the source signatures to the target signatures by using the mapping between source and target signatures;
• and
• using the target signatures, which have been converted from the source signatures using the mapping, to determine whether a threat has occurred to the resources in the computer environment of the target intrusion and detection system;
• and
• outputting by the target intrusion and detection system one or more alerts in response to a determination the threat has occurred to the resources in the computer environment of the target intrusion and detection system.