Systems and methods for rule quality estimation
A method of assessing the quality of a network filter rule containing a wildcard includes determine an instantaneous entropy for the network filter rule based on string distances or instantaneous entropy between a plurality of wildcard matches for the network filter rule. The method further includes performing an action if the string distance or instantaneous entropy for the network filter rule crosses a threshold. The action being selected from disabling the network filter rule, flagging the rule as a low quality rule, generating a candidate rule based on a portion of the match having low entropy and a portion of the match having high entropy, or a combination thereof.
1. A method of assessing the quality of a network filter rule containing a wildcard, comprising:
when the network filter rule is triggered, recording a string matching the wildcard as a wildcard match in a log;
obtaining a plurality of strings from a plurality of wildcard matches for the network filter rule;
determining an instantaneous string entropy for the network filter rule based on the plurality of strings, the instantaneous string entropy being a measure of similarity of the string matches calculated from a histogram of characters in the wildcard matches; and
if the instantaneous entropy for the network filter rule crosses a threshold, flagging the rule as a low quality rule and generating a candidate rule based on a portion of the match having low entropy and a portion of the match having high entropy.
2. The method of claim 1 , wherein the wildcard matches are obtained from an event log.
3. The method of claim 1 , further comprising identifying a temporal substring of the wildcard match and replacing the temporal substring with random characters, the temporal sub string including text that matches a date, time, or event.
4. The method of claim 1 , further comprising identifying a sequence substring of the wildcard match and replacing the sequence substring with random characters, the sequence substring including a sequence of decimal digits corresponding to a sequence number.
5. The method of claim 4 , wherein a processor is further configured to store up to L sequence numbers from the wildcard matches.
6. The method of claim 5 , wherein the sequence number is in a range of i−2L and i+2L, where i is one of the stored sequence numbers.
7. The method of claim 1 , wherein the candidate rule includes the portion of the match having low entropy and a wildcard replacing the portion of the match having high entropy.
8. An information handling system, comprising:
a storage for maintaining a list of network filter rules containing a wildcard and a log of network filtering events;
a processor configured to:
when the network filter rule is triggered, record a string matching the wildcard as a wildcard match in the log;
obtain a plurality of strings from a plurality of wildcard matches for the network filter rule;
determine an instantaneous string entropy for the network filter rule based on the plurality of strings, the instantaneous string entropy being a measure of similarity of the string matches calculated from a histogram of characters in the wildcard matches; and
if the instantaneous entropy for the network filter rule crosses a threshold, flag the rule as a low quality rule and generate a candidate rule based on a portion of the match having low entropy and a portion of the match having high entropy.
9. The information handling system of claim 8 , wherein the processor is further configured to identify a temporal substring of the wildcard match and replace the temporal sub string with random characters, the temporal sub string including text that matches a date, time, or event.
10. The information handling system of claim 8 , wherein the processor is further configured to identify a sequence substring of the wildcard match and replace the sequence sub string with random characters, the sequence sub string including a sequence of decimal digits corresponding to a sequence number.
11. The information handling system of claim 10 , wherein the processor is further configured to store up to L sequence numbers from wildcard matches.
12. The information handling system of claim 11 , wherein the sequence number is in a range of i−2L and i+2L, where i is one of the stored sequence numbers.
13. The information handling system of claim 8 , wherein the candidate rule includes the portion of the match having low entropy and a wildcard replacing the portion of the match having high entropy.
14. A method of assessing the quality of a network filter rule containing a wildcard, comprising:
extracting a plurality of strings from a plurality of wildcard matches of the network filter rule from a log of network filtering events;
determining an instantaneous string entropy for the network filter rule based on a string distance between the plurality of strings, the instantaneous string entropy being a measure of similarity of the string matches calculated from a histogram of characters in the wildcard matches; and
if a score based on the string distance crosses a threshold, flagging the rule as a low quality rule and generating a candidate rule based on a portion of the match having low entropy and a portion of the match having high entropy, wherein the candidate rule includes the portion of the match having low entropy and a wildcard replacing the portion of the match having high entropy.
15. The method of claim 14 , wherein the wildcard matches are obtained from an event log.
16. The method of claim 14 , further comprising identifying a temporal substring of the wildcard match and replace the temporal substring with random characters, the temporal sub string including text that matches a date, time, or event.
17. The method of claim 14 , further comprising identifying a sequence substring of the wildcard match and replace the sequence substring with random characters, the sequence substring including a sequence of decimal digits corresponding to a sequence number.
18. The method of claim 17 , wherein the processor is further configured to store up to L sequence numbers from wildcard matches.
19. The method of claim 18 , wherein the sequence number is in a range of i−2L and i+2L, where i is one of the stored sequence numbers.