Patent ID: 9690937
Date: 2017-06-27
CPC Classifications: G06F,H04L

Claim:
1. A computer-implemented method of providing rules for use in a malicious activity detection system, the computer-implemented method comprising: performing, by processing circuitry, evaluation operations on a plurality of malicious activity detection rules; ranking, by the processing circuitry, the plurality of malicious activity detection rules in an order based on results of the evaluation operations; and based on the order of the plurality of malicious activity detection rules, providing, by the processing circuitry, a malicious activity detection rule report which recommends a set of malicious activity detection rules of the plurality of malicious activity detection rules for use in the malicious activity detection system; wherein performing the evaluation operations on the plurality of malicious activity detection rules includes: deriving, for each rule of the plurality of malicious activity detection rules, a strength value indicating an amount of strength for that rule in detecting malicious activity relative to the other rules of the plurality of malicious activity detection rules; and wherein deriving the overall strength value for each rule includes: generating, for each rule, (i) a precision score which indicates an effectiveness of that rule in correctly identifying malicious activity from activity which is labeled as malicious by the malicious activity detection system, (ii) a recall score which indicates an effectiveness of that rule in correctly identifying malicious activity from actual malicious activity which is handled by the malicious activity detection system, and (iii) a correlation score which indicates a strength of correlation between that rule and malicious activity detection rules which are currently in use by the malicious activity detection system, and providing, as the strength value for each rule, an overall score based on the precision score, the recall score, and the correlation score for that rule.