Cybersecurity typing and inferencing
A cybersecurity event validation service provides a user-friendly scheme for detecting a cyberattack or threat. The cybersecurity event validation service accepts very simple, high-level, user-friendly descriptions of the cyberattack or threat. A user of the cybersecurity event validation service thus need not input detailed hardware/software events that specify the potential cyberattack or threat. The cybersecurity event validation service, instead, validates the user's very simple descriptions for correctness. If the user's very simple descriptions conform to basic rules or requirements, then the cybersecurity event validation service elegantly fills in the deep hardware and software details using context and inferences. The cybersecurity event validation service thus elaborates and enhances the user's very simple descriptions by supplying specific hardware/software details needed to detect the cyberattack or threat. The user thus need not be versed in the intricate programming/configurational details for defining the cyberattack or threat.
1 . A method executed by a computer system that generates a cybersecurity sensor configuration for configuring a cybersecurity agent to detect a cyber threat, comprising:
receiving, by the computer system, a cybersecurity event request sent by the cybersecurity agent monitoring a host operating system, the cybersecurity event request specifying a user's inputs to a cybersecurity event template describing the cyber threat, wherein the user's inputs comprise high-level descriptions of the cyber threat that lack configuration details required to configure the cybersecurity agent;
determining, by the computer system, that the user's inputs conform to a cybersecurity event ontology defining operating system events for detecting the cyber threat;
in response to the determining that the user's inputs conform to the cybersecurity event ontology, generating, by the computer system, the cybersecurity sensor configuration for configuring the cybersecurity agent to detect the operating system events based on the user's inputs comprising the high-level descriptions of the cyber threat; and
detecting, by the computer system, the cyber threat by loading the cybersecurity sensor configuration on the cybersecurity agent monitoring the host operating system for the operating system events.
2 . The method of claim 1 , further comprising determining that the cybersecurity event request fails to conform to the cybersecurity event ontology.
3 . The method of claim 2 , wherein in response to the determining that the cybersecurity event request fails to conform to the cybersecurity event ontology, further comprising generating an error.
4 . The method of claim 1 , wherein the receiving of the cybersecurity event request further comprises receiving the user's inputs as a regular expression.
5 . The method of claim 4 , further comprising receiving the user's inputs as an operation associated with the regular expression.
6 . The method of claim 1 , further comprising inferring the operating system events based on the user's inputs.
7 . The method of claim 1 , further comprising inferring the operating system events based on the cybersecurity event ontology.
8 . A computer system that generates a cybersecurity sensor configuration for configuring a cybersecurity agent to detect a cyber threat, comprising:
a central processing unit; and
a memory device storing instructions that, when executed by the central processing unit, perform operations, the operations comprising:
receiving a cybersecurity event request referencing a user's input to a cybersecurity event template specifying a rule for detecting the cyber threat, wherein the user's inputs comprise high-level descriptions of the cyber threat that lack configuration details required to configure the cybersecurity agent;
determining that the user's input to the cybersecurity event template conforms to a cybersecurity event ontology having database entries that associate the cybersecurity event template to operating system events;
in response to the determining that the user's input to the cybersecurity event template conforms to the cybersecurity event ontology, generating the cybersecurity sensor configuration for configuring the cybersecurity agent to detect the operating system events; and
instructing the cybersecurity agent to detect the cyber threat by installing the cybersecurity sensor configuration that monitors a host operating system for the operating system events.
9 . The computer system of claim 8 , wherein the operations further comprise determining that the cybersecurity event request fails to conform to the cybersecurity event ontology.
10 . The computer system of claim 9 , wherein the operations further comprise generating an error.
11 . The computer system of claim 8 , wherein the operations further comprise receiving the user's input as a regular expression.
12 . The computer system of claim 8 , wherein the operations further comprise receiving the user's input as an operation associated with a regular expression.
13 . The computer system of claim 8 , wherein the operations further comprise inferring the operating system events based on the user's input.
14 . The computer system of claim 8 , wherein the operations further comprise inferring the operating system events based on the cybersecurity event ontology.
15 . A non-transitory computer medium memory device storing instructions that, when executed by a central processing unit, perform operations that generate a cybersecurity sensor configuration, the operations comprising:
receiving a cybersecurity event request referencing a user's input to a cybersecurity event template describing a cybersecurity threat, wherein the user's input comprises high-level descriptions of the cybersecurity threat that lack configuration details required to configure a cybersecurity agent:
determining a common type associated with the cybersecurity event request based on a cybersecurity event ontology;
determining malicious operating system events associated with the cybersecurity threat by querying the cybersecurity event ontology having a database entry that associates the user's input to the malicious operating system events associated with the cybersecurity threat;
gap filling a cybersecurity configuration parameter unspecified by the cybersecurity event request based on the malicious operating system events determined by the querying of the cybersecurity event ontology;
generating the cybersecurity sensor configuration that configures the cybersecurity agent to detect the cybersecurity threat described by the user's input by using the cybersecurity configuration parameter and the malicious operating system events; and
instructing the cybersecurity agent to detect the cybersecurity threat described by the user's input by monitoring a host operating system for the malicious operating system events.
16 . The non-transitory computer medium of claim 15 , wherein the operations further comprise rejecting the cybersecurity event template specified by the cybersecurity event request in response to a mismatch between the cybersecurity event template and the cybersecurity event ontology.
17 . The non-transitory computer medium of claim 15 , wherein the operations further comprise identifying a regular expression described by the user's input to the cybersecurity event template.
18 . The non-transitory computer medium of claim 15 , wherein the operations further comprise determining that the cybersecurity event request fails to conform to the cybersecurity event ontology.
19 . The non-transitory computer medium of claim 18 , wherein the operations further comprise rejecting the cybersecurity event request.
20 . The non-transitory computer medium of claim 18 , wherein the operations further comprise sending the cybersecurity sensor configuration to the cybersecurity agent monitoring the host operating system.