Cyber Attack Severity Scoring Using Weighted Attack Components
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security products fail to accurately rate the severity of network attacks based on both static and dynamic aspects, leading to incorrect threat level scoring and prolonged persistence of dangerous attacks, which can cause significant monetary and reputation impact.
Innovation Solution
A method and system that analyzes network data to determine metadata associated with network attacks, decomposing them into attack objective, method, and execution components, and calculates a severity score using weighted values for each component, generating an alert with the determined score.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing security products use simple threat scoring methods, then the system complexity is low, but the measurement precision of threat severity is insufficient
Solution Approach 1:
The threat severity scoring system is segmented into three distinct components: attack objective component, attack method component, and attack execution component. Each component is evaluated separately using metadata extracted from network data, allowing for precise measurement of different aspects of threat severity while maintaining manageable system complexity through modular evaluation.
Solution Approach 2:
The system changes parameters by introducing multiple scoring dimensions (objective, method, execution) with adjustable weights. Security experts can define and modify parameters such as weight factors for different components, enabling flexible and accurate threat assessment that adapts to different security contexts and requirements.
2Reliability
If security products only consider traffic volume for severity estimation, then the ease of operation is high, but the reliability of threat assessment is insufficient
Solution Approach 1:
The system performs preliminary extraction and analysis of metadata from network data before conducting the actual threat severity assessment. By pre-processing network data to extract relevant metadata about attack objectives, methods, and execution details, the system ensures reliable threat assessment without requiring complex real-time analysis during the scoring process.
Solution Approach 2:
Metadata serves as an intermediary between raw network data and threat severity scoring. The system extracts structured metadata containing information about attack objectives, methods, and execution characteristics, which then feeds into the multi-component scoring system, bridging the gap between simple data collection and reliable threat assessment.
3Productivity
If threat dashboards present all alerts without severity differentiation, then the completeness of information is high, but the productivity of incident response is reduced
Solution Approach 1:
The threat dashboard applies local quality by differentiating alert presentation based on their severity scores. Critical threats with high severity scores receive prominent display and immediate attention, while lower severity threats are presented with less urgency. This allows the system to maintain information completeness while optimizing incident response productivity through prioritized presentation.
Solution Approach 2:
The system performs preliminary severity scoring and categorization of alerts before presenting them on the dashboard. By pre-calculating threat severity scores based on attack objective, method, and execution components, the system can organize and present alerts in a productivity-optimized manner without losing information about individual alert details.
Data Source
AI summary
A computer method and system for determining a threat level score for a detected network attack. Network data is received having a detected network attack, which is then analyzed to determine metadata associated with the network attack. The determined metadata associated with the network attack is analyzed to determine: 1) an attack objective component; 2) an attack method component; and 3) an attack execution component, each being associated with the network attack. A severity score value for the network attack is then determined based upon calculating a weighted value for each of the: 1) an attack objective component; 2) a attack method component; and 3) an attack execution component. And an alert signal/message is then generated for a network attack based upon the determined severity score value.