IOC Filtering for Security Threat Detection

The system segments the large set of IOCs into smaller subsets based on performance scores. High-performing IOCs (above threshold) are monitored continuously across all telemetry data, while low-performing IOCs are monitored selectively or not at all, dividing the monitoring workload into manageable segments that reduce overall computing resource consumption while maintaining detection coverage for the most effective indicators.

The system changes the parameter of IOC selection by introducing performance scores and thresholds. Instead of monitoring all IOCs uniformly, the system evaluates each IOC's performance score and adjusts monitoring based on whether the score exceeds a predefined threshold, thereby optimizing resource allocation between detection coverage and computational efficiency.

The system extracts and removes low-performing IOCs from the monitoring set based on performance score thresholds. By taking out IOCs that consistently generate false positives or have low detection value, the system maintains threat detection capability through high-performing IOCs while reducing the false positive rate caused by ineffective indicators.

The system changes the composition parameter of the IOC set by dynamically adjusting which IOCs are active based on performance scores. IOCs with scores below the threshold are excluded or reduced in monitoring intensity, thereby improving measurement precision by filtering out indicators that contribute disproportionately to false positives while preserving detection capability through high-scoring IOCs.

The system segments IOC monitoring into priority levels based on performance scores. High-performing IOCs are monitored with high priority and processed immediately in telemetry data, while low-performing IOCs are monitored with lower priority or skipped during high-load periods. This segmentation enables comprehensive threat coverage through multiple IOCs while maintaining quick response times for the most effective indicators.

The system applies partial action by monitoring only the subset of IOCs that exceed the performance threshold with full intensity, while applying reduced or selective monitoring to lower-scoring IOCs. This approach maintains comprehensive coverage through the high-performing subset while reducing processing time, as the system does not expend equal resources on every single IOC but rather focuses computational effort where it yields the most timely and accurate results.