Classification of security rules

A system for classifying security rules of a plurality of different security products into a security decision engine in a service, comprising:

• a processing system;
• a memory communicatively connected to the processing system, wherein the memory contains instructions that, when executed by the processing element, configure the processing system to:
• receive at least one security rule from at least one attack database of a security product of the plurality of different security products;
• normalize each of the at least one security rule;
• generate a vector for each of the least one normalized security rule, wherein each vector is generated based on a set of terms indicative of a cyber-solution;
• map each of the generated vector to a security service, wherein the security service represents a cyber-solution category, wherein the mapping is performed using a classification model;
• and
• associate each of the respective security rule with the security service, when an evaluation threshold is met.

A non-transitory computer readable medium having stored thereon instructions for causing one or more processing units to execute a process comprising the steps of:

• receiving at least one security rule from at least one attack database of a security product of the plurality of different security products;
• normalizing each of the at least one security rule;
• generating a vector for each of the least one normalized security rule, wherein each vector is generated based on a set of terms indicative of a cyber-solution;
• mapping each of the generated vector to a security service, wherein the security service represents a cyber-solution category, wherein the mapping is performed using a classification model;
• and
• associating each of the respective security rule with the security service, when an evaluation threshold is met.