Nozomi Networks Sagl

Alexey Kleymenov

Moreno Carullo

Andrea Carcano

Alessandro Di Pinto

The present invention relates to a method for automatic signatures generation from a plurality of sources, comprising defining a plurality of identified sources of samples providers, collecting, by a computerized data processing unit, input samples from the sample providers, verifying, by the computerized data processing unit, the input samples defining verified input samples, generating, by the computerized data processing unit, verified signatures from the verified input samples, storing, in a verified signatures database operatively connected to the computerized data processing unit, the verified signatures, wherein the collecting comprises extracting raw IoCs from the input samples, wherein the verifying comprises evaluating the reputation of each of the raw IoCs according to predefined reputation rules and comparing each of the raw IoCs with a database of existing signatures operatively connected to the data processing unit to define allowable raw IoCs; and wherein the generating comprises creating the verified signatures from the verified input samples corresponding to the allowable raw IoCs.

Method for automatic signatures generation from a plurality of sources

The present invention relates to a method for evaluating quality of signature-based detections in an infrastructure provided with a plurality of sensors, comprising defining predefined rules for the rule-based detections, wherein the rules are of a silent type such that operate without generating alerts to the user of the infrastructure, collecting telemetry events at each of the sensors, storing the telemetry events of each of the sensors to respective local sensor databases operatively connected to the sensors, aggregate, at predetermined aggregating time intervals, the telemetry events from the local sensor databases to a central database, analyzing the telemetry events at the central database, by evaluating the telemetry events with respect to the rules and calculating the quality measurements of the rules, according to a plurality of predefined quality metrics in a predefined metrics time interval, wherein the quality metrics comprise precision metric, by counting the instances of false positives of the telemetry events with respect to the predefined rules, recall metric, by counting the instances of false negatives of the telemetry events with respect to the predefined rules and performance metric, by counting the instances of rules hits over predefined evaluation time interval and the ratio between the partial and full of the rules matching, wherein the method for evaluating quality of rule-based detections further comprises releasing verified rules for the rule-based detections as predefined rules having the quality measurements within a predetermined quality target range, and wherein the verified rules are of alerting type such that operate generating alerts to the user of the infrastructure.

Method for evaluating quality of rule-based detections

The present invention relates to a method for automatic aggregating and enriching data from honeypots comprising defining a plurality of identified honeypots of a different type to be monitored in a network; collecting metadata and samples from said honeypots of a different type in said network, which in turn comprises defining a predefined collection model for the honeypots such as to collect homogeneous metadata and samples among the honeypots of a different type, extracting the metadata according to the collection model defining a model metadata, and extracting the samples according to the collection model defining model samples; enriching said metadata and sample collected, which in turn comprises scanning the model metadata to extract IoCs, scanning the model samples to extract IoCs, recursively scanning the model samples to generate secondary model metadata and scanning the secondary model metadata to extract IoCs, until no further IoCs can be generated, recursively obtaining secondary samples from the extracted IoCs and scanning the secondary model samples to extract IoCs, until no further secondary samples are obtained; and aggregating said metadata and samples collected and/or enriched, which in turn comprises aggregating metadata by a predefined metadata model aggregation and aggregating samples by a predefined samples model aggregation.

Growing community of inventors

Massagno, Switzerland

Alexey Kleymenov