管控难控问题：为安全运营中心设计高效、低噪声的网络入侵检测规则
Ruling the Unruly: Designing Effective, Low-Noise Network Intrusion Detection Rules for Security Operations Centers
AI总结：
该研究通过分析商业SOC的在用规则、结合设计师访谈总结出六项NIDS规则设计原则，验证其可在维持检测覆盖的同时降低分析师不必要工作量，为SOC优化入侵检测规则提供指导。
摘要：
如今许多安全运营中心（SOC）仍高度依赖基于特征的网络入侵检测系统（NIDS），例如Suricata。入侵检测规则的特异性以及规则集提供的覆盖范围是SOC相关专业群体普遍关注的问题，这些因素会影响自动化告警后处理方法的有效性。我们假设，更好地理解影响规则质量的因素能够帮助解决当前SOC面临的问题。\n本文中，我们对一家服务于教育、IT管理等行业客户的合作商业（托管）SOC所使用的规则进行了特征分析。在此过程中，我们发现了六项相关的设计原则，并通过与该SOC内经验丰富的规则设计师访谈对这些原则进行了巩固。随后我们通过定量评估这些原则对规则特异性的影响，验证了设计原则的有效性。\n我们发现，其中若干设计考量因素会显著影响规则带来的不必要工作量。例如，利用代理进行检测的规则、未采用告警节流的规则，以及未区分恶意行动成功/失败的规则，会给SOC分析师带来显著更多的工作量。此外，为提升覆盖范围而匹配通用特征以检测恶意行为的规则，也会显著增加工作量，这表明必须在规则特异性和覆盖范围之间取得平衡。我们的研究表明，尽管当前普遍存在违反这些设计原则的情况，但将其应用于SOC中可以在维持覆盖范围的同时减少工作量。
英文摘要：
Many Security Operations Centers (SOCs) today still heavily rely on signature-based Network Intrusion Detection Systems (NIDS) such as Suricata. The specificity of intrusion detection rules and the coverage provided by rulesets are common concerns within the professional community surrounding SOCs, which impact the effectiveness of automated alert post-processing approaches. We postulate a better understanding of factors influencing the quality of rules can help address current SOC issues. In this paper, we characterize the rules in use at a collaborating commercial (managed) SOC serving customers in sectors including education and IT management. During this process, we discover six relevant design principles, which we consolidate through interviews with experienced rule designers at the SOC.We then validate our design principles by quantitatively assessing their effect on rule specificity. We find that several of these design considerations significantly impact unnecessary workload caused by rules. For instance, rules that leverage proxies for detection, and rules that do not employ alert throttling or do not distinguish (un)successful malicious actions, cause significantly more workload for SOC analysts. Moreover, rules that match a generalized characteristic to detect malicious behavior, which is believed to increase coverage, also significantly increase workload, suggesting a tradeoff must be struck between rule specificity and coverage. We show that these design principles can be applied successfully at a SOC to reduce workload whilst maintaining coverage despite the prevalence of violations of the principles.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
