Recommending a set of malicious activity detection rules in an automated, data-driven manner

Patent metadata

Field	Value
Publication number	US-9690937-B1
Application number	US-201514672849-A
Country	US
Kind code	B1
Filing date	Mar 30, 2015
Priority date	Mar 30, 2015
Publication date	Jun 27, 2017
Grant date	Jun 27, 2017

Abstract

A computer-implemented technique provides rules for use in a malicious activity detection system. The technique involves performing evaluation operations on a plurality of malicious activity detection rules. The technique further involves ranking the plurality of malicious activity detection rules in an order based on results of the evaluation operations (e.g., sorting the rules systematically in an order based on measures such as precision, recall, correlation to other rules already in use, etc.). The technique further involves, based on the order of the plurality of malicious activity detection rules, providing a malicious activity detection rule report which recommends a set of malicious activity detection rules of the plurality of malicious activity detection rules for use in the malicious activity detection system.

First claim

What is claimed is:

1. A computer-implemented method of providing rules for use in a malicious activity detection system, the computer-implemented method comprising:
performing, by processing circuitry, evaluation operations on a plurality of malicious activity detection rules;
ranking, by the processing circuitry, the plurality of malicious activity detection rules in an order based on results of the evaluation operations; and
based on the order of the plurality of malicious activity detection rules, providing, by the processing circuitry, a malicious activity detection rule report which recommends a set of malicious activity detection rules of the plurality of malicious activity detection rules for use in the malicious activity detection system;

wherein performing the evaluation operations on the plurality of malicious activity detection rules includes:
deriving, for each rule of the plurality of malicious activity detection rules, a strength value indicating an amount of strength for that rule in detecting malicious activity relative to the other rules of the plurality of malicious activity detection rules; and

wherein deriving the overall strength value for each rule includes:
generating, for each rule, (i) a precision score which indicates an effectiveness of that rule in correctly identifying malicious activity from activity which is labeled as malicious by the malicious activity detection system, (ii) a recall score which indicates an effectiveness of that rule in correctly identifying malicious activity from actual malicious activity which is handled by the malicious activity detection system, and (iii) a correlation score which indicates a strength of correlation between that rule and malicious activity detection rules which are currently in use by the malicious activity detection system, and
providing, as the strength value for each rule, an overall score based on the precision score, the recall score, and the correlation score for that rule.

2. A computer-implemented method as in claim 1 wherein the results of the evaluation operations include a plurality of numerical scores for the plurality of malicious activity detection rules; and wherein ranking the plurality of malicious activity detection rules in the order includes:
sorting the plurality of malicious activity detection rules based on the numerical scores for the plurality of malicious activity detection rules.

3. A computer-implemented method as in claim 1 , further comprising:
prior to performing the evaluation operations, creating a set of new malicious activity detection rules and including the set of new malicious activity detection rules in the plurality of malicious activity detection rules.

4. A computer-implemented method as in claim 3 wherein creating the set of new malicious activity detection rules includes:
performing random forest operations to generate the set of new malicious activity detection rules.

5. A computer-implemented method as in claim 3 wherein creating the set of new malicious activity detection rules includes:
using association rules to generate the set of new malicious activity detection rules.

6. A computer-implemented method as in claim 3 wherein creating the set of new malicious activity detection rules includes:
providing, for a particular new malicious activity detection rule, a set of thresholds to define an aspect of that rule.

7. A computer-implemented method as in claim 1 , further comprising:
based on the malicious activity detection rule report which recommends the set of malicious activity detection rules, introducing a new malicious activity detection rule into the malicious activity detection system to detect malicious activity, the new malicious activity detection rule being selected from the set of malicious activity detection rules.

8. A computer-implemented method as in claim 7 wherein the malicious activity detection system is constructed and arranged to detect malware at rest within a computerized device; and wherein introducing the new malicious activity detection rule includes:
configuring malware detection circuitry to detect malware at rest within the computerized device using the new malicious activity detection rule.

9. A computer-implemented method as in claim 7 wherein the malicious activity detection system is constructed and arranged to detect malware inflight within a computerized network; and wherein introducing the new malicious activity detection rule includes:
configuring malware detection circuitry to detect malware inflight within the computerized network using the new malicious activity detection rule.

10. A computer-implemented method as in claim 7 wherein the malicious activity detection system is constructed and arranged to detect fraudulent activity during authentication; and wherein introducing the new malicious activity detection rule includes:
configuring malware detection circuitry to detect fraudulent activity during authentication using the new malicious activity detection rule.

11. A computer-implemented method as in claim 1 wherein the plurality of malicious activity detection rules includes a set of rules that detects malicious code within data currently stored in non-volatile memory.

12. A computer program product having a non-transitory computer readable medium which stores a set of instructions to provide rules for use in a malicious activity detection system, the set of instructions, when carried out by computerized circuitry, causing the computerized circuitry to perform a method of:
performing evaluation operations on a plurality of malicious activity detection rules;
ranking the plurality of malicious activity detection rules in an order based on results of the evaluation operations; and
based on the order of the plurality of malicious activity detection rules, providing a malicious activity detection rule report which recommends a set of malicious activity detection rules of the plurality of malicious activity detection rules for use in the malicious activity detection system;

wherein performing the evaluation operations on the plurality of malicious activity detection rules includes:
deriving, for each rule of the plurality of malicious activity detection rules, a strength value indicating an amount of strength for that rule in detecting malicious activity relative to the other rules of the plurality of malicious activity detection rules; and

wherein deriving the overall strength value for each rule includes:
generating, for each rule, (i) a precision score which indicates an effectiveness of that rule in correctly identifying malicious activity from activity which is labeled as malicious by the malicious activity detection system, (ii) a recall score which indicates an effectiveness of that rule in correctly identifying malicious activity from actual malicious activity which is handled by the malicious activity detection system, and (iii) a correlation score which indicates a strength of correlation between that rule and malicious activity detection rules which are currently in use by the malicious activity detection system, and
providing, as the strength value for each rule, an overall score based on the precision score, the recall score, and the correlation score for that rule.

13. A computer program product as in claim 12 wherein the results of the evaluation operations include a plurality of numerical scores for the plurality of malicious activity detection rules; and wherein ranking the plurality of malicious activity detection rules in the order includes:
sorting the plurality of malicious activity detection rules based on the n

Assignees

• Emc Corp
• Emc Ip Holding Co Llc

Inventors

• Duchin Zohar
• Kaufman Alon
• Zaslavsky Alex
• Rosa Martin
• Nguyen Luan

Classifications

• G06F2221/2139

  Recurrent verification · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title

• G06F21/562 Primary

  Static detection · CPC title