发表机构
Independent Researcher, Bengaluru, India; Department of Computer Science and Engineering, Amrita School of Computing, Amrita Vishwa Vidyapeetham, Bengaluru, India（独立研究者; 阿穆里克大学阿姆丽塔计算机学院计算机科学工程系）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
该研究针对SigmaHQ语料库，发现检测规则库中的排除项累积且持续存在，提出了语义检测抑制的确定性方法，并给出优先检查排除项的标准。
AI 中文摘要
当一条规则产生过多误报时，分析人员会添加一个排除项，此后该规则在该情况下将不再发出警报。每一个这样的决定在局部都是合理的，但它们的整体影响尚不明确。近期的纵向研究已证实，规则整理不会收敛，但仅测量了后来被撤销的修订的恢复时间——该测量未涉及从未被撤销的规则窄化情况，而本研究正是针对这一点展开测量。在SigmaHQ语料库9年的8234次修订中，我们从语义层面检测到抑制现象：被否定的谓词集合增长，而覆盖范围未出现相应增长，并通过盲法人工标注验证了该检测方法（精确率0.828，召回率0.911）。该检测方法是确定性的：未从数据中学习任何内容，且相关定义以代码形式公开。排除项被添加1642次，被撤回304次，比例为5.4:1，在单个规则层面该比例升至13:1。31%的窄化对结构比较不可见，因此现有结构分析方法低估了该情况。通过Kaplan-Meier法估计，86.7%的排除项在3年后仍有效，且其持续性与该规则是否是其ATT&CK技术的唯一覆盖规则无关（p=0.49）。在路径相关的排除项中，64.1%可被选择文件名的低权限进程满足。窄化会累积，很少被重新审视，且不会按后果进行分类。我们给出了一个标准，用于决定优先检查哪些排除项。
英文摘要
When a rule produces too many false alarms an analyst adds an exclusion, and the rule thereafter declines to alert in that circumstance. Each such decision is locally reasonable; what becomes of them collectively is not known. Recent longitudinal work established that curation does not converge, but measured restoration time only for revisions that were later reverted -- a measure silent about narrowing that is never undone. We measure that. Across nine years and 8,234 revisions of the SigmaHQ corpus we detect suppression semantically -- growth in the set of predicates held under negation without compensating growth in coverage -- and validate it against blinded hand labelling (precision 0.828, recall 0.911). The test is deterministic: nothing is learned from the data, and the definitions are released as code. Exclusions were added 1,642 times and withdrawn 304, a ratio of 5.4 to 1 that rises to 13 to 1 at the level of the individual rule. Thirty-one per cent of the narrowing is invisible to structural comparison, which existing structural accounts therefore undercount. Estimated by Kaplan-Meier, 86.7 per cent of exclusions remain in force three years on, and persistence is independent of whether the rule is the only coverage for its ATT&CK technique (p = 0.49). Of path-valued exclusions, 64.1 per cent can be satisfied by an unprivileged process that chooses a filename. Narrowing accumulates, is rarely revisited, and is not triaged by consequence. We give a criterion for deciding which exclusions to examine first.
Comments18 pages, 7 figures, 3 tables. A version of this work has been submitted to Computers & Security. Code and data: https://doi.org/10.5281/zenodo.22107282
