Patent ID: 11909773
Assignee: TARGET BRANDS, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 16:
17. A method for evaluating security detection rules in a network security computing environment, the method comprising:
retrieving, by a computing system, results for a processed log of security events, wherein the results identify determined outcomes for instances triggering a plurality of security detection rules, wherein each of the plurality of security detection rules is configured to detect a specific network behavior on a network through being processed against a log of security events;
determining, by the computing system, scores for the plurality of security detection rules based on the results of the processed log of security events and the determined outcomes, wherein determining scores for the plurality of security detection rules comprises:
determining, for each rule of the plurality of security detection rules, a number of times that the rule was properly triggered;
assigning a low score based on the number of times that the rule was properly triggered exceeding a first threshold value; and
assigning a high score based on the number of times that the rule was properly triggered being less than the first threshold value;

ranking, by the computing system, the plurality of security detection rules based on the scores, wherein the plurality of security detection rules are ranked from a highest score to a lowest score, wherein the highest score indicates that a corresponding rule is performing worst among the plurality of security detection rules and the lowest score indicates that a corresponding rule is performing best among the plurality of security detection rules; and
generating, by the computing system, a rules score report based on the ranked rules.