Apparatuses for optimizing rule to improve detection accuracy for exploit attack and methods thereof
AssigneeKorea Internet & Security Agency
InventorsMi Joo Kim, Woong Go, Hong Geun Kim, Sung Taek Oh, Jae Hyuk Lee, Soon Tai Park
Life of this patent
Estimating the term…
Abstract
An apparatus comprising a processor to execute the rule optimizer to perform a number of operations. One operation comprises obtaining 5 log data including a result of detecting an exploit attack based on a rule. Another operation comprises time-series analyzing the obtained log data to update at least some of previously applied detection rules. There is provided an apparatus for automatically optimizing a rule to improve the detection accuracy for an exploit attack in a rule-based attack detection system, and a method performed on the apparatus.
Claims17
An apparatus for optimizing a rule, comprising:
- a memory to store a rule optimizer;
- a processor to execute the rule optimizer to:
- obtain log data including a result of detecting an exploit attack based on the rule;
- time-series analyze the obtained log data;
- derive increasing or decreasing trends for detection rates of previously applied detection rules;
- raise a priority of application of one of the previously applied detection rules in which the derived trend of the detection rate is the increasing trend;
- update at least some of the previously applied detection rules applied to a second domain by using log data of a first domain, the first domain having a similarity with the second domain greater than a reference value,
- wherein the similarity is determined based on a similarity between information on a first device belonging to the first domain and information on a second device belonging to the second domain,
- wherein the information on the first device and the second device include at least one of a device name, a manufacturer, an operating system, and a firmware.
An apparatus for optimizing a rule, comprising:
- a memory to store a rule optimizer;
- a processor to execute the rule optimizer to:
- obtain device information associated with a device belonging to a target domain;
- determine an exploit attack associated with the device by using the obtained device information;
- derive increasing or decreasing trends for detection rates of previously applied detection rules by time-series analyzing the obtained device information;
- raise a priority of application of one of the previously applied detection rules in which the derived trend of the detection rate is the increasing trend;
- update an existing rule set of the target domain with a rule set for detecting the determined exploit attack based on at least characteristics of the target domain, and
- update at least some of the previously applied detection rules applied to a second domain by using log data of a first domain, the first domain having a similarity with the second domain greater than a reference value,
- wherein the similarity is determined based on a similarity between information on a first device belonging to the first domain and information on a second device belonging to the second domain,
- wherein the information on the first device and the second device include at least one of a device name, a manufacturer, an operating system, and a firmware.
A method for optimizing a rule, the method being performed by a computing device, and comprising:
- obtaining log data including a result of detecting an exploit attack based on the rule;
- time-series analyzing the obtained log data;
- derive increasing or decreasing trends for detection rates of previously applied detection rules;
- raise a priority of application of one of the previously applied detection rules in which the derived trend of the detection rate is the increasing trend;
- updating at least some of the previously applied detection rules applied to a second domain by using log data of a first domain, the first domain having a similarity with the second domain greater than a reference value,
- wherein the similarity is determined based on a similarity between information on a first device belonging to the first domain and information on a second device belonging to the second domain,
- wherein the information on the first device and the second device include at least one of a device name, a manufacturer, an operating system, and a firmware.
Dependencies are inferred from the claim text.