Profiling cyber threats detected in a target environment and automatically generating one or more rule bases for an expert system usable to profile cyber threats detected in a target environment

A method of automatically generating one or more rule bases for an expert system usable to profile cyber threats detected in a target environment, comprising the steps of:

• for each alert of a training set of alerts triggered by a potential cyber threat detected by an SIEM:
• retrieving, by at least one computer processor, captured packet data related to the alert;
• and
• extracting, by the at least one computer processor, training threat data pertaining to a set of attributes from captured packet data triggering the alert;
• generating, by the at least one computer processor, a predictive model of the level of risk posed by an alert based on attribute values for that alert by analysing the captured training threat data pertaining to the set of attributes;
• and
• generating, by the at least one computer processor, a set of fuzzy rules based on the predictive model, said rules being usable at run time in a fuzzy logic engine to evaluate data pertaining to one or more of the extracted attributes of a detected cyber threat to determine values for one or more output variables indicative of a level of an aspect of risk attributable to the detected cyber threat;
• wherein the fuzzy logic comprises one or more rule bases comprising fuzzy rules and being usable to evaluate a CT risk indicator, and
• wherein each fuzzy rule of a rule base has:
• as an antecedent, a fuzzy set of one or more input fuzzy variables each representative of a said attribute and any logical operators connecting input fuzzy variables, and
• as a consequent, a fuzzy set of an output fuzzy variable representative of the CT risk indicator.

Computing apparatus for profiling cyber threats detected in a target environment, comprising:

• one or more processors;
• and
• computer readable medium comprising instructions which when executed, cause the computing apparatus to be operable to carry out the method comprising:
• receiving, from a Security Information and Event Manager (SIEM) monitoring the target environment, alerts triggered by a detected potential cyber threat, and, for each alert:
• retrieving by a processor captured packet data related to the alert;
• extracting by said processor data pertaining to a set of attributes from captured packet data triggering the alert;
• and
• applying fuzzy logic to data pertaining to one or more of the attributes to determine values for one or more output variables indicative of a level of an aspect of risk attributable to the cyber threat;
• wherein the fuzzy logic comprises one or more rule bases comprising fuzzy rules and being usable to evaluate a CT risk indicator, and
• wherein each fuzzy rule of a rule base has:
• as an antecedent, a fuzzy set of one or more input fuzzy variables each representative of a said attribute and any logical operators connecting input fuzzy variables, and
• as a consequent, a fuzzy set of an output fuzzy variable representative of the CT risk indicator.

A non-transitory computer readable medium comprising instructions which when executed, cause computing apparatus having one or more processors to be operable to carry out the method comprising:

• receiving, from a Security Information and Event Manager (SIEM) monitoring the target environment, alerts triggered by a detected potential cyber threat, and, for each alert:
• retrieving by a processor captured packet data related to the alert;
• extracting by said processor data pertaining to a set of attributes from captured packet data triggering the alert;
• and
• applying fuzzy logic to data pertaining to one or more of the attributes to determine values for one or more output variables indicative of a level of an aspect of risk attributable to the cyber threat;
• wherein the fuzzy logic comprises one or more rule bases comprising fuzzy rules and being usable to evaluate a CT risk indicator, and
• wherein each fuzzy rule of a rule base has:
• as an antecedent, a fuzzy set of one or more input fuzzy variables each representative of a said attribute and any logical operators connecting input fuzzy variables, and
• as a consequent, a fuzzy set of an output fuzzy variable representative of the CT risk indicator.