IOC Infrastructure Syntax Tree Deduplication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection systems face inefficiencies due to duplication of Indicators of Compromise (IOCs) and multiple scanning of attributes, leading to slower detection processes.
Innovation Solution
A system and method utilizing an IOC infrastructure embedded with a syntax tree to process and unify IOCs from various formats, preventing duplication and optimizing scanning by converting raw IOCs into a unified format and applying syntax rules for efficient storage and comparison.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If multiple formats of IOCs are aggregated and processed, then the comprehensiveness of threat intelligence is improved, but the time required for scanning and processing increases
Solution Approach 1:
The system performs preliminary parsing and normalization of IOCs from multiple formats before storage. By pre-processing and converting all IOC formats into a unified internal representation, the system avoids repeated format conversion during scanning operations, thus reducing scanning time while maintaining support for multiple input formats.
Solution Approach 2:
The system changes the parameter of IOC representation by converting diverse formats into a standardized internal format. This parameter transformation allows the system to accept multiple input formats while maintaining a single, efficient data structure for storage and scanning operations, thereby reducing processing time.
2Reliability
If IOC attributes are processed multiple times for validation and classification, then the accuracy of malware detection is improved, but the productivity of the detection process decreases
Solution Approach 1:
The system performs preliminary parsing, validation, and classification of IOC attributes during the initial ingestion phase. By completing these operations upfront and storing the processed attributes in a normalized format, the system avoids repeated processing during detection scans, thereby maintaining accuracy while improving productivity.
Solution Approach 2:
The system creates a normalized copy of IOC attributes in a standardized internal format. This copy preserves all necessary information for accurate malware detection while eliminating redundancy and processing overhead associated with multiple format conversions and validations during scanning operations.
3Quantity of substance
If raw IOCs from multiple sources are collected without filtering, then the volume of available threat intelligence is improved, but the amount of duplicate and redundant data increases
Solution Approach 1:
The system extracts and removes duplicate IOC entries during the parsing and normalization phase. By identifying and filtering out redundant data points before storage, the system maintains a comprehensive collection of threat intelligence while eliminating duplicate entries, thus improving the quality-to-quantity ratio of the IOC database.
Solution Approach 2:
The system changes the parameter of data representation by normalizing IOC attributes into a standardized format. This normalization process naturally eliminates duplicates by converting equivalent entries from different sources into identical representations, allowing the system to maintain comprehensive IOC volume while reducing redundancy.
Data Source
AI summary
The IOC Infrastructure management system (100) and method is disclosed for building an IOC infrastructure and its management thereof. The system mainly includes a IOC processing unit and an endpoint engine. The IOC processing unit is configured to i) source raw IOCs from a plurality of external sources, ii) convert format of the raw IOCs into a predetermined format of an IOC database using a parser unit, where each parser of the parser unit corresponds to at least one IOC format, iii) build and apply syntax tree to the parsed IOCs, where the syntax tree supports complex expression-based toolsets, such as YARA, and sort the IOCs lexicographically to avoid duplication of IOC entry and render the malware detection scanning process faster and efficient.