Improved tools and techniques for generating stateful rules for behavior-based threat detection enable threat analysts, who do not have advanced computer programming skills, to quickly and easily generate high-level representations of stateful behavioral rules, which are then compiled into a format suitable for execution by a stateful rule processing engine. In some examples, the high-level representations of stateful rules are coded in a high-level, domain specific language (DSL). The DSL may provide high-level primitives suitable for (1) expressing sequences of attack behaviors, (2) tagging computational entities (e.g., threads, processes, applications, systems, users, etc.) with states (e.g., user-defined states), and/or (3) performing operations on endpoint nodes (e.g., reporting activity, blocking activity, terminating processes, etc.).
Stateful rule generation for behavior based threat detection
2024-01-23
Patent
Elektronische Ressource
Englisch
IPC: | B60W CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION , Gemeinsame Steuerung oder Regelung von Fahrzeug-Unteraggregaten verschiedenen Typs oder verschiedener Funktion / H04L TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION , Übertragung digitaler Information, z.B. Telegrafieverkehr / G06F ELECTRIC DIGITAL DATA PROCESSING , Elektrische digitale Datenverarbeitung |
STATEFUL RULE GENERATION FOR BEHAVIOR BASED THREAT DETECTION
Europäisches Patentamt | 2022
|Behavior Trees with Stateful Tasks
Springer Verlag | 2015
|IATA acts on radio spectrum threat . Eurocontrol sets rule-making deadline
Online Contents | 1999
Composite magnetic detection threat
Tema Archiv | 1997
|