Patent ID: 11930027
Assignee: NOZOMI NETWORKS SAGL
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC G  H

Claim 0:
1. A method for evaluating quality of rule-based detections in an infrastructure provided with a plurality of sensors, comprising:
defining predefined rules for said rule-based detections, wherein said rules are of a silent type such that operate without generating alerts to the user of said infrastructure;
collecting telemetry events at each of said sensors;
storing said telemetry events of each of said sensors to respective local sensor databases operatively connected to said sensors;
aggregate, at predetermined aggregating time intervals, said telemetry events from said local sensor databases to a central database;
analyzing said telemetry events at said central database, by evaluating said telemetry events with respect to said rules and calculating the quality measurements of said rules, according to a plurality of predefined quality metrics in a predefined metrics time interval;, wherein said quality metrics comprise:
precision metric, by counting the instances of false positives of said telemetry events with respect to said predefined rules;
recall metric, by counting the instances of false negatives of said telemetry events with respect to said predefined rules; and
performance metric, by counting the instances of rules hits over predefined evaluation time interval and the ratio between the partial and full of said rules matching;, wherein said method for evaluating quality of rule-based detections further comprises releasing verified rules for said rule-based detections as predefined rules having said quality measurements within a predetermined quality target range, and, wherein said verified rules are of alerting type such that operate generating alerts to the user of said infrastructure.