标题： 管理无序：为安全运营中心设计有效且低噪声的网络入侵检测规则 显示英文标题

标题： Ruling the Unruly: Designing Effective, Low-Noise Network Intrusion Detection Rules for Security Operations Centers

摘要： 许多安全运营中心（SOCs）目前仍然严重依赖基于特征的网络入侵检测系统（NIDS），例如Suricata。 入侵检测规则的具体性以及规则集提供的覆盖范围是围绕SOC的专业社区中的常见问题，这会影响自动化警报后处理方法的有效性。 我们假设对影响规则质量的因素有更深入的理解，可以帮助解决当前的SOC问题。 在本文中，我们描述了一个合作的商业（托管）SOC中的规则，该SOC为包括教育和IT管理在内的多个行业客户提供服务。 在此过程中，我们发现了六个相关的设计原则，这些原则通过与SOC中经验丰富的规则设计师进行访谈得到整合。然后，我们通过定量评估这些原则对规则具体性的影响来验证我们的设计原则。 我们发现，其中一些设计考虑因素显著影响由规则引起的不必要的工作量。 例如，利用代理进行检测的规则，以及不使用警报限流或不区分（未）成功的恶意行为的规则，会显著增加SOC分析人员的工作量。 此外，那些匹配通用特征以检测恶意行为的规则，尽管被认为可以增加覆盖范围，但也显著增加了工作量，这表明在规则具体性和覆盖范围之间必须做出权衡。 我们展示了这些设计原则可以在SOC中成功应用，从而在保持覆盖范围的同时减少工作量，即使这些原则存在普遍违反的情况。 显示英文摘要

摘要： Many Security Operations Centers (SOCs) today still heavily rely on signature-based Network Intrusion Detection Systems (NIDS) such as Suricata. The specificity of intrusion detection rules and the coverage provided by rulesets are common concerns within the professional community surrounding SOCs, which impact the effectiveness of automated alert post-processing approaches. We postulate a better understanding of factors influencing the quality of rules can help address current SOC issues. In this paper, we characterize the rules in use at a collaborating commercial (managed) SOC serving customers in sectors including education and IT management. During this process, we discover six relevant design principles, which we consolidate through interviews with experienced rule designers at the SOC.We then validate our design principles by quantitatively assessing their effect on rule specificity. We find that several of these design considerations significantly impact unnecessary workload caused by rules. For instance, rules that leverage proxies for detection, and rules that do not employ alert throttling or do not distinguish (un)successful malicious actions, cause significantly more workload for SOC analysts. Moreover, rules that match a generalized characteristic to detect malicious behavior, which is believed to increase coverage, also significantly increase workload, suggesting a tradeoff must be struck between rule specificity and coverage. We show that these design principles can be applied successfully at a SOC to reduce workload whilst maintaining coverage despite the prevalence of violations of the principles.