Multi-stage security ruleset filtering to reduce attack coverage redundancy

Abstract

A multi-stage, dual-paradigm redundancy filter for security ruleset management as disclosed herein efficiently manages growth of a resident security ruleset—the resident security ruleset being the managed security ruleset. In a first stage, the redundancy filter operates according to a 'rule matching' paradigm. In a second stage, the redundancy filter operates according to an “attack coverage matching” paradigm. For the first stage, the redundancy rule filter removes those rules in an input ruleset that have a complete or partial rule match in the resident security ruleset. For the second stage, the redundancy filter removes those of the remaining rules of the first stage filtered, input ruleset that match attack coverage of rules in the resident security ruleset. A security system then updates the resident security ruleset based on the rules remaining after the multi-stage, dual-paradigm filtering.