公开(公告)号：GB2598214A

公开(公告)日：2022-02-23

申请号：GB202111756

申请日：2020-04-28

Applicant: IBM

Inventor： TIM SCHEIDELER ,  RAGHAVENDRA ARJUN UDUPI ,  IVAN JAMES REEDMAN ,  MATTHIAS SEUL

IPC: H04L9/00

Abstract: A method for processing security events by applying a rule-based alarm scheme may be provided. The method includes generating a rule index of rules and an indicator of compromise index for each of the rules. The method includes also processing the incomingsecurity event by applying the rules, increasing a current rule counter relating to a triggered rule, and increasing a current indicator of compromise counter pertaining to the triggered rule. Furthermore, the method includes generating a pseudo security event from received data about known attacks and related indicators of compromise, processing the pseudo security events by sequentially applying the rules, increasing a current rule counter of pseudo security events, and increasing a current indicator of compromise counter for pseudo security events, and sorting the rules and sorting within each rule the indicator of compromise values in the indicator of compromise index.