# US 2021/0243230 A1 · Domain Specific Language for Defending Against a Threat-Actor and Adversarial Tactics, Techniques, and Procedures > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0243230 A1 - Document ID: US20210243230A1 - Status: Published application - Kind: A1 - Application number: 17/216,632 - Filed: 2021-03-29 - Published: 2021-08-05 - Earliest claimed: 2019-04-15 - Assignees: Qualys, Inc. - Applicants: Qualys, Inc. - Inventors: Mayuresh Vishwas Dani; Ankur S. Tyagi - Web page: https://patentgrep.com/patent/US20210243230A1 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1433: {Vulnerability analysis} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04W 12/128: Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract The present disclosure describes defending against an attack execution operation. According to one aspect of the subject matter described in this disclosure, a method for generating a domain-specific language (DSL) file is disclosed. The method may comprise determining, a framework based on an attack repository, determining a first primitive based on the framework, and determining a second primitive based on the framework. In one implementation, the first primitive and the second primitive are fundamental structures or constructs within a DSL. The method further comprises combining the first primitive and the second primitive into a DSL file. In one implementation, the DSL file is executed to defend against a first attack execution operation executed by a threat-actor. ## Claims ### Claim 1 A method comprising: determining, using one or more computing device processors, a framework based on an attack repository, the attack repository comprising attack data captured from multiple computing devices associated with different entities, the attack data comprising one or more of: a plurality of attack execution operations, one or more attackers associated with the plurality of attack execution operations, and one or more resources associated with the plurality of attack execution operations, determining, using one or more computing device processors, a first primitive based on the framework, the first primitive comprising: a first identifier defining a first attack execution operation comprised in the plurality of attack execution operations, a first descriptor indicating an attack type associated with the first attack execution operation, a second descriptor indicating a vulnerability type associated with the first attack execution operation, a third descriptor indicating a stability parameter associated with the first attack execution operation, a fourth descriptor indicating intensity data associated with the first attack execution operation, determining, using one or more computing device processors, a second primitive based on the framework, the second primitive indicating one or more defense information associated with the first attack execution operation, the second primitive comprising at least a first defense step comprised in the one or more defense information against the first attack execution operation, the first defense step comprising: a second identifier defining the first defense step, and a parameter indicating a security measure for defending against the first attack execution operation, and combining, using one or more computing device processors, the first primitive and the second primitive into a domain specific language (DSL) file, the DSL file being executed to defend against the first attack execution operation. ### Claim 2 (depends on 1) The method of claim 1, wherein the DSL file is useable to generate binaries executable within a specific domain, such that a security system outside the specific domain cannot execute the DSL file. ### Claim 3 (depends on 1) The method of claim 1, wherein the attack type comprises one of a pre-attack type, a mobile attack type, and an enterprise attack type. ### Claim 4 (depends on 3) The method of claim 3, wherein: the pre-attack type indicates whether a first attack step associated with the first attack execution operation is executed to: select a first target, obtain information about the first target, and execute the first attack execution operation on the first target; the mobile attack type indicates whether the first attack step is executed as part of the first attack execution operation on a second target, the second target comprising a mobile computing environment; and the enterprise attack type indicates whether the first attack step is executed as part of the first attack execution operation on a third target, the third target comprising an enterprise computing environment. ### Claim 5 (depends on 1) The method of claim 1, wherein the vulnerability type associated with the first attack execution operation is one of: a public vulnerability indicating that the first attack execution operation is associated with a publicly known attack execution operation; a private vulnerability indicating that the first attack execution operation is associated with a private attack execution operation; and a custom vulnerability indicating that the first attack execution operation is associated with a custom attack execution operation. ### Claim 6 (depends on 1) The method of claim 1, wherein the stability parameter associated with the first attack execution operation comprises one of: a low stability parameter indicating that the DSL file is substantially unstable when executed; a medium stability parameter indicating that the DSL file is actively monitored when executed; and a high stability parameter indicating that the DSL file is substantially stable when executed. ### Claim 7 (depends on 1) The method of claim 1, wherein the intensity data associated with the first attack execution operation comprises one of a low intensity data, a medium intensity data, and a high intensity data. ### Claim 8 (depends on 1) The method of claim 1, wherein the parameter comprises one or more computer security applications selected from a group comprising: a filesystem, an event viewer, a system monitor, an antivirus application, an intrusion prevention system (IPS) application, and a security information and event management (SIEM) application. ### Claim 9 (depends on 8) The method of claim 8, wherein the parameter is executed based on one or more of: a file type, a file path, and a security event. ### Claim 10 (depends on 9) The method of claim 9, wherein the security event comprises one or more security commands that detects one or more attack steps associated with the first attack execution operation. ### Claim 11 (depends on 1) The method of claim 1, wherein the framework is MITRE ATT&CK framework. ### Claim 12 A computer program product comprising a non-transitory computer useable medium including a computer readable code, wherein the computer readable code when executed using one or more computing device processors, causes the one or more computing device processors to: determine a framework based on an attack repository, the attack repository comprising attack data captured from multiple computing devices associated with different entities, the attack data comprising one or more of: a plurality of attack execution operations, one or more attackers associated with the plurality of attack execution operations, and one or more resources associated with the plurality of attack execution operations, determine a first primitive based on the framework, the first primitive comprising: a first identifier defining a first attack execution operation comprised in the plurality of attack execution operations, a first descriptor indicating an attack type associated with the first attack execution operation, a second descriptor indicating a vulnerability type associated with the first attack execution operation, a third descriptor indicating a stability parameter associated with the first attack execution operation, a fourth descriptor indicating intensity data associated with the first attack execution operation, determine a second primitive based on the framework, the second primitive indicating one or more defense information associated with the first attack execution operation, the second primitive comprising at least a first defense step associated with at least one resource comprised in the one or more resources associated with the plurality of attack, the first defense step comprising: a second identifier defining the first defense step, and a parameter indicating a security measure for defending against the first attack execution operation, and combine the first primitive and the second primitive into a domain specific language (DSL) file that defends against the first attack execution operation, the DSL file being useable to generate binaries executable within a specific domain, such that a security system outside the specific domain cannot execute the DSL file. ### Claim 13 (depends on 12) The computer program product of claim 12, wherein the parameter comprises one or more computer security applications selected from a group comprising: a filesystem, an event viewer, a system monitor, an antivirus application, an intrusion prevention system (IPS) application, and a security information and event management (SIEM) application. ### Claim 14 (depends on 12) The computer program product of claim 12, wherein the parameter is executed based on one or more of: a file type, a file path, and a security event. ### Claim 15 (depends on 14) The computer program product of claim 14, wherein the security event comprises one or more security commands that detects one or more attack steps associated with the first attack execution operation. ### Claim 16 (depends on 15) The computer program product of claim 15, wherein the framework is MITRE ATT&CK framework. ### Claim 17 A system comprising: one or more computing system processors; and memory storing instructions that, when executed by the one or more computing system processors, causes the system to: determine a framework based on an attack repository, the attack repository comprising attack data captured from multiple computing devices associated with different entities, the attack data comprising one or more of: a plurality of attack execution operations, one or more attackers associated with the plurality of attack execution operations, or one or more resources associated with the plurality of attack execution operations, determine a first primitive based on the framework, the first primitive comprising: a first identifier defining a first attack execution operation comprised in the plurality of attack execution operations, a first descriptor indicating an attack type associated with the first attack execution operation, a second descriptor indicating a vulnerability type associated with the first attack execution operation, a third descriptor indicating a stability parameter associated with the first attack execution operation, a fourth descriptor indicating intensity data associated with the first attack execution operation, determine a second primitive based on the framework, the second primitive indicating one or more defense information associated with the first attack execution operation, the second primitive comprising at least a first defense step associated with at least one resource comprised in the one or more resources associated with the plurality of attack, the first defense step comprising: a second identifier defining the first defense step, and a parameter indicating a security measure for defending against the first attack execution operation, and combine the first primitive and the second primitive into a file that defends against the first attack execution operation, the file being useable to generate binaries executable within a specific domain, such that a security system outside the specific domain cannot execute the file. ### Claim 18 (depends on 17) The system of claim 17, wherein the defense information is associated with at least one resource comprised in the plurality of resources, the at least one resource being selected from a resource group comprising: a filesystem, an event viewer, a system monitor, an antivirus application, an intrusion prevention system (IPS) application, and a security information and event management (SIEM) application. ### Claim 19 (depends on 18) The system of claim 18, wherein the parameter associated with the first defense step is based on the at least one resource. ### Claim 20 (depends on 17) The system of claim 17, wherein the framework is MITRE ATT&CK framework.