Patent ID: 11909773
Assignee: TARGET BRANDS, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 7:
8. A system for evaluating security detection rules in a network security computing environment, the system comprising:
a network security system configured to (i) receive a log of security events for a network and (ii) process the log of security events against a plurality of security detection rules, wherein each of the plurality of security detection rules is configured to detect a specific network behavior on the network through being processed against the log of security events;
a log results data store configured to:
receive, from the network security system, results for the processed log of security events against the plurality of security detection rules; and
store the results for the processed log of security events;

a detection hub system for assessing the plurality of security detection rules that were triggered by processing of the log of security events, the detection hub system configured to:
retrieve, from the log results data store, the results for the processed log of security events, wherein the results identify determined outcomes for instances triggering the plurality of security detection rules;
determine scores for the plurality of security detection rules based on the results of the processed log of security events and the determined outcomes;
adjust the scores for the plurality of security detection rules relative to scores of each nearest neighbor of a respective rule;
rank the plurality of security detection rules based on the scores, wherein the plurality of security detection rules are ranked from a highest score to a lowest score, wherein the highest score indicates that a corresponding rule is performing worst among the plurality of security detection rules and the lowest score indicates that a corresponding rule is performing best among the plurality of security detection rules, wherein ranking the plurality of security detection rules based on the scores of each nearest neighbor of the respective rule comprises:
generating an initial ranking of the plurality of security detection rules based on the highest score to the lowest score;
applying a use case to the respective rule;
decreasing, in response to determining that the respective rule satisfies the use case, a score of the respective rule relative to scores of each nearest neighbor of the respective rule in the initially ranked rules;
increasing, in response to determining that the respective rule does not satisfy the use case, the score of the respective rule relative to the scores of each nearest neighbor of the respective rule in the initially ranked rules; and
generating a finalized ranking of the rules; and

generate, based on the finalized ranked rules, a rules score report; and

a user computing device having a graphical user interface (GUI) display, the user computing device configured to:
receive, from the detection hub system, the rules score report;
output, for display at the GUI display, the rules score report;
modify, based on the rules score report, one or more of the rules identified in the rules score report; and
store, in a rules data store, the modified one or more rules.