Attack Technique Tag Confidence in Extended Detection Analytics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing detection and response systems lack accuracy in labeling attack techniques due to variability and subjectivity in mapping threat detection to attacker techniques, leading to incorrect remedial actions and potential harm to systems.
Innovation Solution
Implement a second layer of analytics in the extended detection and response system, utilizing a technique database, an attack detection method scoring model, and an attack technique analytics engine to compute a confidence rating and perform gap analysis for improving the accuracy of attack technique tags.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a single detection artifact is used to map attacker techniques, then the detection process is simple and fast, but the accuracy of the technique tag is low and varies greatly
Solution Approach 1:
The patent segments the detection process into multiple independent detection artifacts, each focusing on specific aspects of the attack (e.g., network traffic analysis, file system monitoring, registry changes). Each artifact independently evaluates different indicators and produces separate technique assessments, which are then aggregated to form a comprehensive technique tag with higher accuracy.
Solution Approach 2:
The patent merges multiple detection artifacts and their associated technique assessments into a unified technique tag. By combining results from various detection sources and methodologies, the system produces a consolidated technique identification that leverages the strengths of each individual detection artifact, thereby improving overall accuracy.
2Reliability
If multiple detection sources are used to improve accuracy, then the confidence in technique tagging increases, but the system complexity and resource consumption increase
Solution Approach 1:
The patent implements preliminary action by pre-configuring detection rules, thresholds, and artifact templates before actual attack detection occurs. Detection artifacts are pre-compiled with known indicators and evaluation criteria, allowing the system to quickly match incoming data against predefined patterns rather than performing complex real-time analysis, thus reducing computational overhead while maintaining high reliability.
Solution Approach 2:
The detection system employs self-service mechanisms where detection artifacts automatically correlate their findings with the knowledge base and previously identified threats. The system self-updates its detection capabilities by learning from new attack patterns while maintaining confidence in established technique tags, reducing the need for continuous heavy computational resources.
3Measurement precision
If comprehensive data analysis is performed to ensure accurate technique identification, then the precision of attack detection improves, but the time required for detection and response increases
Solution Approach 1:
The patent implements periodic action by organizing detection artifacts to evaluate different aspects of potential attacks at specific intervals or triggers. Rather than continuously analyzing all data streams simultaneously, the system periodically activates specific detection artifacts based on event triggers or time-based schedules, maintaining high detection precision while reducing overall processing time through structured, phased analysis.
Data Source
AI summary
Techniques for providing a confidence rating for an attack technique tag and a guidance for improving the confidence rating are described. An attack technique analytics engine receives telemetry data, a notification that an attack has been detected using an attack detection source, the notification including an attack technique tag indicating an attack technique used in the attack, and attack technique data including a likelihood of a particular attack technique, from among multiple attack techniques, occurring determined using a particular attack detection source from among multiple attack detection sources. Based on the telemetry, the attack technique tag, and the attack technique data, a confidence rating that the attack corresponds to the attack technique is determined. The attack detection source and attack technique are analyzed to determine a guidance for improving the confidence rating, and the rating and guidance are appended to the attack technique tag.