Improved tools and techniques for generating stateful rules for behavior-based threat detection enable threat analysts, who do not have advanced computer programming skills, to quickly and easily generate high-level representations of stateful behavioral rules, which are then compiled into a format suitable for execution by a stateful rule processing engine. In some examples, the high-level representations of stateful rules are coded in a high-level, domain specific language (DSL). The DSL may provide high-level primitives suitable for (1) expressing sequences of attack behaviors, (2) tagging computational entities (e.g., threads, processes, applications, systems, users, etc.) with states (e.g., user-defined states), and/or (3) performing operations on endpoint nodes (e.g., reporting activity, blocking activity, terminating processes, etc.).
STATEFUL RULE GENERATION FOR BEHAVIOR BASED THREAT DETECTION
2022-11-24
Patent
Elektronische Ressource
Englisch
Stateful rule generation for behavior based threat detection
Europäisches Patentamt | 2024
|Behavior Trees with Stateful Tasks
Springer Verlag | 2015
|IATA acts on radio spectrum threat . Eurocontrol sets rule-making deadline
Online Contents | 1999
A High-Speed Stateful Packet Processing Approach for Tbps Programmable Switches
BASE | 2023
|