Signature quality evaluation
Systems and methods for scanning network activity. The methods include receiving at an interface connection data regarding a plurality of network connections, wherein the connection data includes a signature used to classify each of the plurality of network connections; determining, using one or more processors executing instructions stored on memory to provide a signature analysis engine configured to analyze the connection data, the signature is prohibitively prone to misclassifying network activity as malicious, wherein the determination is based on the analysis of the connection data; and implementing a signature policy to prevent the signature from misclassifying network activity as malicious.
1. A method for evaluating a signature for scanning network activity, the method comprising:
receiving at an interface connection data regarding a plurality of network connections, wherein the connection data includes:
a signature used to classify each of the plurality of network connections, and
a domain of a destination of each of the plurality of network connections;
determining, using one or more processors executing instructions stored on memory to provide a signature analysis engine configured to analyze the connection data, the signature is prone to misclassifying network activity as malicious based on the analysis of the connection data, wherein the signature is determined to be prone to misclassifying network activity as malicious based on the signature having a greater than a threshold probability of misclassifying network activity as malicious, wherein the threshold probability is based on a number of connection sessions on which a signature triggered based on domain data and a number of sessions for which domain data is available; and
implementing a signature policy to prevent the signature from misclassifying network activity as malicious.
2. The method of claim 1 , wherein the method further includes comparing the domain data to a data store of labeled domains.
3. The method of claim 1 , wherein the connection data includes internet protocol (IP) address data associated with each of the plurality of network connections, and the method further includes comparing the IP address data to a data store of labeled IP addresses.
4. The method of claim 1 , wherein implementing the signature policy includes modifying the signature to be at least less likely to misclassify network activity as malicious.
5. The method of claim 1 , wherein implementing the signature policy includes disabling the signature to prevent the signature from scanning network activity.
6. The method of claim 1 , further comprising determining a confidence value associated with the determination that the signature is prone to misclassifying network activity as malicious.
7. The method of claim 6 , wherein the signature policy is implemented upon the confidence value exceeding a threshold value.
8. The method of claim 1 wherein determining that the signature is prone to misclassifying network activity as malicious includes calculating a probability that the signature will misclassify network activity as malicious.
9. The method of claim 8 wherein the calculated probability is further based on
an internet protocol (IP) probability that the signature is likely to misclassify network activity as malicious based on IP address data of the connection data.
10. The method of claim 1 wherein the determination that the signature is prone to misclassifying network activity as malicious is made without knowledge of content of the signature.
11. A system for evaluating a signature for scanning network activity, the system comprising:
an interface for at least receiving connection data regarding a plurality of network connections, wherein the connection data includes:
a signature used to classify each of the plurality of network connections, and
a domain of a destination of each of the plurality of network connections; and
one or more processors executing instructions stored on memory to provide a signature analysis engine that is configured to:
determine, using one or more processors executing instructions stored on memory to provide a signature analysis engine configured to analyze the connection data, the signature is prone to misclassifying network activity as malicious, wherein the signature is determined to be prone to misclassifying network activity as malicious based on the signature having a greater than a threshold probability of misclassifying network activity as malicious, wherein the threshold probability is based on a number of connection sessions on which a signature triggered based on domain data and a number of sessions for which domain data is available; and
implement a signature policy to prevent the signature from misclassifying network activity as malicious.
12. The system of claim 11 , wherein the signature analysis engine is further configured to compare the domain data to a data store of labeled domains.
13. The system of claim 11 wherein the connection data includes internet protocol (IP) address data associated with each of the plurality of network connections, and the signature analysis engine is further configured to compare the IP address data to a data store of labeled IP addresses.
14. The system of claim 11 , wherein the signature analysis engine implements the signature policy by modifying the signature to be at least less likely to misclassify network activity as malicious.
15. The system of claim 11 , wherein the signature analysis engine implements the signature policy by disabling the signature to prevent the signature from scanning network activity.
16. The system of claim 11 wherein the signature analysis engine is further configured to determine a confidence value associated with the determination that the signature is prone to misclassifying network activity as malicious.
17. The system of claim 16 wherein the signature analysis engine implements the signature policy upon the confidence value exceeding a threshold value.
18. The system of claim 11 , wherein the signature analysis engine determines the signature is prone to misclassifying network activity as malicious by calculating a probability that the signature will misclassify network activity as malicious.
19. The system of claim 18 , wherein the calculated probability is further based on
an internet protocol (IP) probability that the signature is likely to misclassify network activity as malicious based on IP address data of the connection data.
20. The system of claim 11 , wherein the signature analysis engine determines that the signature is prone to misclassify network activity as malicious without knowledge of content of the signature.