Patent ID: 11909773
Assignee: TARGET BRANDS, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 0:
1. A system for evaluating security detection rules in a network security computing environment, the system comprising:
a network security system configured to (i) receive a log of security events for a network and (ii) process the log of security events against a plurality of security detection rules, wherein each of the plurality of security detection rules is configured to detect a specific network behavior on the network through being processed against the log of security events;
a log results data store configured to:
receive, from the network security system, results for the processed log of security events against the plurality of security detection rules; and
store the results for the processed log of security events;

a detection hub system for assessing the plurality of security detection rules that were triggered by processing of the log of security events, the detection hub system configured to:
retrieve, from the log results data store, the results for the processed log of security events, wherein the results identify determined outcomes for instances triggering the plurality of security detection rules;
determine scores for the plurality of security detection rules based on the results of the processed log of security events and the determined outcomes,
wherein the detection hub system is configured to determine scores for the plurality of security detection rules by:
determining, for each rule of the plurality of security detection rules, a number of times that the rule was properly triggered;
assigning a low score based on the number of times that the rule was properly triggered exceeding a first threshold value; and
assigning a high score based on the number of times that the rule was properly triggered being less than the first threshold value;

rank the plurality of security detection rules based on the scores, wherein the plurality of security detection rules are ranked from a highest score to a lowest score, wherein the highest score indicates that a corresponding rule is performing worst among the plurality of security detection rules and the lowest score indicates that a corresponding rule is performing best among the plurality of security detection rules; and
generate, based on the ranked rules, a rules score report; and

a user computing device having a graphical user interface (GUI) display, the user computing device configured to:
receive, from the detection hub system, the rules score report;
output, for display at the GUI display, the rules score report;
modify, based on the rules score report, one or more of the rules identified in the rules score report; and
store, in a rules data store, the modified one or more rules.