IoC Quality Scoring for Reliable Malicious IP Assessment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods lack a standardized and scalable approach to assess the quality of network-related Indicators of Compromise (IoCs), leading to issues with false positives and inefficiencies in managing IoCs of varying natures, especially in automated systems.
Innovation Solution
A method for assessing IoCs quality by classifying them as IP Address, Domain Name, or URL type, calculating quality scores based on predefined ranges and databases, and evaluating against standardized thresholds to identify maliciousness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If automated methods are used to generate and manage Indicators of Compromise, then productivity is improved, but reliability deteriorates due to increased false positives and quality issues
Solution Approach 1:
The patent implements a feedback mechanism where quality scores are calculated for each IoC based on multiple attributes (source reliability, age, activity level, etc.). These scores feed back into the automated management system to filter and prioritize IoCs, ensuring that only high-quality indicators are deployed. This resolves the contradiction by maintaining automated efficiency while improving reliability through systematic quality assessment.
Solution Approach 2:
The patent changes the parameter of IoC evaluation by introducing a multi-dimensional quality scoring system that assesses IoCs based on source reliability, age, activity level, and other attributes. This transforms the raw IoC data into quality-assessed indicators, enabling the system to maintain high productivity while ensuring reliability through parameter-based filtering.
2Adaptability or versatility
If multiple types of Indicators of Compromise are managed without standardized classification, then adaptability is improved, but device complexity increases
Solution Approach 1:
The patent segments IoCs into distinct types (IP addresses, domain names, URLs, file hashes) and applies type-specific quality assessment criteria to each. This segmentation allows the system to handle diverse IoC types adaptably while managing complexity through organized classification and specialized processing rules for each category.
Solution Approach 2:
The patent implements a universal quality scoring framework that can assess multiple types of IoCs (IP addresses, domain names, URLs, file hashes) using a common set of principles and attributes. This multi-functional approach maintains adaptability across different IoC types while reducing system complexity through standardized assessment procedures.
3Reliability
If comprehensive quality assessment of Indicators of Compromise is performed, then reliability is improved, but loss of time increases due to additional processing steps
Solution Approach 1:
The patent performs preliminary quality assessment of IoCs when they are first ingested into the system, calculating quality scores based on source reliability, age, and other attributes before they are deployed for threat detection. This preliminary action ensures reliability is improved while minimizing time loss during actual threat response operations, as the assessment work is done in advance.
Solution Approach 2:
The patent implements a quality scoring system that calculates scores based on multiple attributes but allows for selective application and threshold-based filtering. Not all attributes need to be fully evaluated for every IoC, and partial assessment can be performed when time is critical, balancing reliability improvement with time constraints through flexible application of the assessment process.
Data Source
AI summary
The present invention relates to a method for assessing the quality of network-related Indicators of Compromise comprising the phase of calculating, by a computerized data processing unit, a quality score for Indicators of Compromise of the IP Address type, the steps of assigning an autonomous system score of the IP Address according to a predefined range of values based on a database of autonomous system owners, assigning a subnet score of said IP Address according to a predefined range of values based on a database of subnet owners, assigning a services hosted score of the IP Address according to a predefined range of values based on known malicious services hosted by the IP Address before the phase of calculating the quality score, calculating the IP Address quality score as sum of the autonomous system score, subnet score and services hosted score and wherein the method comprises a phase of evaluating the calculated quality score comprises, for each of the Indicators of Compromise of the IP Address type, the step of assessing the Indicators of Compromise of the IP Address type as malicious when the IP Address quality score exceed a predefined IP Address quality threshold.