DISC Model for IOC Scoring in Virus Campaign Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current threat reports on virus attacks relying on Indicators of Compromise (IOCs) are too general and lack scoring guidance, leading to binary decisions that often result in either blocking or ignoring IOCs without context, which can cause significant problems as indicators of imminent attacks are not acted upon effectively.
Innovation Solution
Implementing a deterministic indicator and confidence scoring (DISC) model that processes IOCs using a DISC scoring structure with lethality, determinism, and confidence components to provide a comprehensive assessment, enabling the identification of virus campaigns by querying an indicator database and determining the likelihood and credibility of indicators.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If IOCs are used without scoring guidance, then the system remains simple, but the ability to accurately identify virus campaigns deteriorates
Solution Approach 1:
The patent segments the IOC assessment into three distinct scoring components: lethality (impact severity), determinism (predictability of attack), and confidence (reliability of indicator). This segmentation allows each component to be evaluated independently using specific criteria, improving measurement precision while maintaining manageable system complexity through structured decomposition.
Solution Approach 2:
The patent introduces quantitative parameter changes by assigning numerical scores (0-100) to each assessment component. The lethality component scores impact severity, the determinism component scores attack predictability, and the confidence component scores indicator reliability. These parameter transformations enable precise differentiation between IOCs and facilitate automated decision-making based on threshold values.
2Productivity
If binary blocking or ignoring decisions are made, then the response process remains simple, but the effectiveness of attack response deteriorates
Solution Approach 1:
The patent transforms the static binary decision model into a dynamic multi-dimensional assessment framework. Instead of simple block/don't block decisions, the system dynamically evaluates IOCs across three dimensions (lethality, determinism, confidence) and adjusts responses based on scored thresholds. This dynamic approach enables nuanced responses such as enhanced monitoring, selective blocking, or prioritized investigation based on the combined score profile.
Solution Approach 2:
The patent implements feedback mechanisms where the scored assessment results feed back into the decision-making process. The DISC scores provide quantitative feedback that guides whether to block, monitor, or ignore an IOC, and this feedback loop can be iterated as new information becomes available. The feedback from scoring directly influences operational responses, improving effectiveness while maintaining clear decision criteria.
3Measurement precision
If general threat indicators are used, then the system remains straightforward, but the ability to distinguish campaign-specific indicators deteriorates
Solution Approach 1:
The patent applies local quality by evaluating different aspects of IOCs through specialized lenses: lethality assessment focuses on impact severity specific to each indicator, determinism assessment focuses on the predictability and campaign-specific nature of the indicator, and confidence assessment focuses on the reliability and uniqueness of the indicator. This localized evaluation approach enables precise differentiation between generic and campaign-specific indicators while maintaining a structured, manageable framework.
Data Source
AI summary
Methods, apparatus, systems, and articles of manufacture are disclosed. In one example, an apparatus includes at least one memory, instructions, and processor circuitry. The processor circuitry at least executes or instantiates the instructions to receive a group of indicators from a campaign attack, then query an indicator database with an indicator from the group of indicators, and then predict an identification of the campaign attack in response to the indicator having a current deterministic indicator and confidence scoring (DISC) score in the indicator database, wherein the DISC score represents at least one of a lethality component, a determinism component, or a confidence component of the indicator.