System and method for SIEM rule sorting and conditional execution
A method for processing security events by applying a rule-based alarm scheme may be provided. The method includes generating a rule index of rules and an indicator of compromise index for each of the rules. The method includes also processing the incoming security event by applying the rules, increasing a current rule counter relating to a triggered rule, and increasing a current indicator of compromise counter pertaining to the triggered rule. Furthermore, the method includes generating a pseudo security event from received data about known attacks and related indicators of compromise, processing the pseudo security events by sequentially applying the rules, increasing a current rule counter of pseudo security events, and increasing a current indicator of compromise counter for pseudo security events, and sorting the rules and sorting within each rule the indicator of compromise values in the indicator of compromise index.
1. A method for processing security events by applying a rule-based alarm scheme for determining whether a received security event is considered as offense, the method comprising:
generating a respective indicator of compromise index for each rule in a rule index, each respective indicator of compromise index comprising indicator values of indicators of compromise to be used for a comparison against an attribute of a security event;
processing an incoming security event by sequentially applying the rules in the rule index, wherein processing the incoming security event comprises:
increasing a current rule counter relating to a triggered rule, wherein the triggered rule comprises a respective one of the rules that triggered an offense during the processing, and
increasing a current indicator of compromise counter pertaining to the triggered rule, wherein the current indicator of compromise counter comprises a different counter than the current rule counter;
sorting the rules in the rule index according to a rule likelihood of triggering an offense, wherein the sorting the rules is based on respective weighted rule counter values;
sorting, for each rule, the indicators of compromise in the respective indicator of compromise index according to an indicator of compromise likelihood of triggering an offense, wherein the sorting the indicators of compromise is based on weighted current indicator of compromise counter values; and
processing another incoming security event by sequentially applying the sorted rules contained in the rule index.
2. The method according to claim 1 , wherein the sorting the rules also comprises:
determining the weighted rule counter values by combining weighted past rule counter values and weighted current rule counter values of the rule.
3. The method according to claim 1 , wherein the sorting, within each rule, the indicators of compromise also comprises:
determining the weighted indicator of compromise counter values by combining weighted past indicator of compromise value counter values and weighted current indicator of compromise counter values of the respective indicator of compromise.
4. The method according to claim 1 , wherein the increasing the current rule counter comprises:
increasing the current rule counter by a fixed number or by a number indicative of a severity of the offense.
5. The method according to claim 1 , wherein the increasing the current indicator of compromise counter also comprises:
increasing the current indicator of compromise counter by a fixed number.
6. The method according to claim 1 , further comprising:
generating a pseudo security event from received data about known attacks and related indicators of compromise; and
processing the pseudo security events by sequentially applying the rules in the rule index, wherein processing the pseudo security events comprises:
increasing a current rule counter of pseudo security events relating to the triggered rule which processing has triggered the offense, and
increasing a current indicator of compromise counter for pseudo security events pertaining to the triggered rule.
7. The method according to claim 6 , wherein the generating the pseudo security event comprises one selected from a group consisting of:
applying a tactic-technique-procedure (TTP) identifying data from the received data about known attacks, wherein the received data about known attacks are received via a structured threat information expression (STIX) protocol;
generating a pseudo security event for each phase of a sequence of partial cyber-attacks represented by attack patterns; and
generating a pseudo security event for each indicator of compromise relating to a respective rule.
8. The method according to claim 6 , where the generating a pseudo security event also comprises:
resetting a current rule counter of pseudo security events to zero; and
resetting a current indicator of compromise counter for pseudo security events to zero.
9. The method according to claim 1 , wherein the sorting the rules in the rule index comprises:
determining the weighted rule counter based on a predefined percentage value, predefined weighing factor values, a past rule counter comprising a number of offenses counted previously, an observed events counter comprising a number of offenses generated in a current time window for real events, and a pseudo security counter comprising a number offenses generated in the current time window for pseudo events.
10. The method according to claim 1 , also comprising:
buffering the incoming security event after a predetermined first number of rules have been processed and within each processed rule a predetermined second number of indicator of compromise counter groups have been processed; and
continue the processing of the buffered security event if a processing load of incoming security events decreases below a predefined load threshold value.
11. A SIEM system for processing security events by applying a rule-based alarm scheme for determining whether a received security event is considered as offense, the system comprising:
a processor;
one or more computer readable storage medium; and
program instructions stored on the one or more computer readable storage medium, the program instructions being executable by the processor to:
process an incoming security event by sequentially applying rules in a rule index, wherein processing the incoming security event comprises: increasing a current rule counter relating to a triggered rule and increasing a current indicator of compromise counter pertaining to the triggered rule, wherein the current indicator of compromise counter comprises a different counter than the current rule counter;
sort the rules in the rule index according to a rule likelihood of triggering an offense, wherein the sorting the rules is based on respective weighted rule counter values;
sort, for each rule, indicators of compromise in a respective indicator of compromise index according to an indicator of compromise likelihood of triggering an offense, wherein the sorting the indicators of compromise is based on weighted current indicator of compromise counter values; and
process another incoming security event by sequentially applying the sorted rules contained in the rule index.
12. The system according to claim 11 , wherein the indicators of compromise comprise respective artifacts observed on a network or in an operating system that indicate a computer intrusion.
13. The system according to claim 11 , wherein not all incoming security events are processed against all the rules.
14. The system according to claim 11 , wherein the sorting the rules in the rule index comprises:
determining the weighted rule counter based on a past rule counter comprising a number of offenses counted previously, an observed events counter comprising a number of offenses generated in a current time window for real events, and a pseudo security counter comprising a number offenses generated in the current time window for pseudo events.
15. The system according to claim 11 , wherein the program instructions are executable by the processor to:
buffer the incoming security event after a predetermined first number of rules have been processed and within each processed rule a predetermined second number of indicator of compromise counter groups have been processed; and
continue the processing of the buffered security event if a processing load of incoming security events decreases below a predefined load threshold value.
16. A computer program product for processing security events by applying a rule-based alarm scheme for determining whether a received security event is considered as offense, the computer program product comprising:
one or more computer readable storage medium and program instructions stored on at least one of the one or more computer readable storage medium, the program instructions executable by a processor to:
process an incoming security event by sequentially applying rules in a rule index, wherein processing the incoming security event comprises: increasing a current rule counter relating to a triggered rule and increasing a current indicator of compromise counter pertaining to the triggered rule, wherein the current indicator of compromise counter comprises a different counter than the current rule counter;
sort the rules in the rule index according to a rule likelihood of triggering an offense, wherein the sorting the rules is based on respective weighted rule counter values;
sort, for each rule, indicators of compromise in a respective indicator of compromise index according to an indicator of compromise likelihood of triggering an offense, wherein the sorting the indicators of compromise is based on weighted current indicator of compromise counter values; and
process another incoming security event by sequentially applying the sorted rules contained in the rule index.
17. The computer program product according to claim 16 , wherein the indicators of compromise comprise respective artifacts observed on a network or in an operating system that indicate a computer intrusion.
18. The computer program product according to claim 16 , wherein not all incoming security events are processed against all the rules.
19. The computer program product according to claim 16 , wherein the sorting the rules in the rule index comprises:
determining the weighted rule counter based on a past rule counter comprising a number of offenses counted previously, an observed events counter comprising a number of offenses generated in a current time window for real events, and a pseudo security counter comprising a number offenses generated in the current time window for pseudo events.
20. The computer program product according to claim 16 , wherein the program instructions are executable by the processor to:
buffer the incoming security event after a predetermined first number of rules have been processed and within each processed rule a predetermined second number of indicator of compromise counter groups have been processed; and
continue the processing of the buffered security event if a processing load of incoming security events decreases below a predefined load threshold value.