Scoring the performance of security products

Abstract

A method and system for scoring performance of a security product are provided. The method includes receiving security product performance data of the security product configured to handle a specific cyber threat; classifying the performance data into a product profile associated with the security product; computing at least one security product performance score for the product profile based on the classified product security performance data; and associating the at least one security performance score with the product profile. In an embodiment, the method also includes selecting the at least one security product from a plurality of security products based on their respective performance scores for the respective cyber threat.

What is claimed is: 
     
         1 . A method for scoring performance of a security product, comprising:
 receiving security product performance data of the security product configured to handle a specific cyber threat;   classifying the performance data into a product profile associated with the security product;   computing at least one security product performance score for the product profile based on the classified product security performance data; and   associating the at least one security performance score with the product profile.   
     
     
         2 . The method of  claim 1 , further comprising:
 computing at least one security performance score for each of a plurality of security products; and   selecting the at least one security product from the plurality of security products based on their respective performance scores for the respective cyber threat.   
     
     
         3 . The method of  claim 1 , wherein the security product performance data includes any of: security rules saved in an attack database and application logs produced by the at least one security product. 
     
     
         4 . The method of  claim 3 , wherein the at least one security performance score includes at least one of: an offline score, a runtime score, and a unified score. 
     
     
         5 . The method of  claim 4 , wherein the offline score is computed based on the security rules in the attack database. 
     
     
         6 . The method of  claim 5 , further comprising:
 for each security rule in the attack database computing at least one of: a coverage parameter, a risk parameter, and accuracy parameter; and   computing the offline score is a function of the at least one of: the coverage parameter, the risk parameter, and the accuracy parameter.   
     
     
         7 . The method of  claim 4 , wherein the runtime score is computed based on the attack logs. 
     
     
         8 . The method of  claim 4 , wherein the unified score is at least a function of the runtime score and the offline score. 
     
     
         9 . The method of  claim 8 , wherein the function is any one of: a weight function, a threshold-based function, and a fuzzy logic function. 
     
     
         10 . The method of  claim 9 , wherein weights utilized by any of the weight function and the fuzzy logic function are adaptively changed based on the previously computed performance scores. 
     
     
         11 . The method of  claim 1 , wherein classifying the security product performance data further comprising:
 normalizing each security rule or attack log;   generating a vector for each security rule or attach log, wherein each vector is generated based on a set of terms indicative of a cyber-solution;   mapping each of the generated vectors to a security engine with in a security service, wherein the security service is configured per a cyber-solution category and the security engine is configured per a specific cyber threat; and   associating each of the respective security rule or attack log with a product profile maintained by the security engine, when an evaluation threshold is met.   
     
     
         12 . The method of  claim 11 , wherein the security service includes any of: an intrusion detection system (IDS), Network behavior analysis system, an anti-malware system, a reputation security system, an anti-virus (AV), and a Web application (WAF). 
     
     
         13 . A non-transitory computer readable medium having stored thereon instructions for causing processing circuitry to perform the method of  claim 1 . 
     
     
         14 . A method for selecting a security product among a plurality of security products for protecting a protected entity, comprising:
 for each of the plurality of security products:
 receiving security product performance data of the security product configured to handle a specific cyber threat;
 classifying the product performance data into a product profile associated with the security product; 
 computing at least one security performance score for the product profile based on the classified security product performance data; 
 
   associating the at least one security performance score with the product profile; and   selecting at least one security product from the plurality of security products based on their respective performance scores.   
     
     
         15 . The method of  claim 14 , wherein the security product performance data includes any of: security rules saved in an attack database and application logs produced by the security product. 
     
     
         16 . The method of  claim 15 , wherein the at least one security performance score includes at least one of: an offline score, a runtime score, and a unified score. 
     
     
         17 . The method of  claim 16 , wherein the offline score is computed based on the security rules in the attack database. 
     
     
         18 . The method of  claim 16 , wherein the runtime score is computed based on the attack logs. 
     
     
         19 . The method of  claim 16 , wherein the unified score is at least a function of the runtime score and the offline score. 
     
     
         20 . The method of  claim 19 , wherein the function is any one of: a weight function, a threshold-based function, and a fuzzy logic function. 
     
     
         21 . The method of  claim 20 , wherein weights utilized by any of the weight function and the fuzzy logic function are adaptively changed based on the previously computed performance scores. 
     
     
         22 . The method  claim 14 , further comprising:
 benchmarking the plurality of security products based on the security performance score computed for each of the plurality of security products.   
     
     
         23 . A non-transitory computer readable medium having stored thereon instructions for causing processing circuitry to perform the method of  claim 14 . 
     
     
         24 . A system for selecting a security product among a plurality of security products for protecting a protected entity, comprising:
 a processing circuitry; and   a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:   receive security product performance data of the security product configured to handle a specific cyber threat;   classify the performance data into a product profile associated with the security product;   compute at least one security product performance score for the product profile based on the classified product security performance data; and   associate the at least one security performance score with the product profile.   
     
     
         25 . The system of  claim 24 , wherein the at least one security performance score includes at least one of: an offline score, a runtime score, and a unified score. 
     
     
         26 . A system for scoring performance of a security product, comprising:
 a processing circuitry; and   a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
 receive security product performance data of the security product configured to handle a specific cyber threat; 
 classify the product performance data into a product profile associated with the security product; 
 compute at least one security performance score for the product profile based on the classified security product performance data; 
 associate the at least one security performance score with the product profile; and 
 select at least one security product of the plurality of security products based on their respective performance scores. 
   
     
     
         27 . The system of  claim 26 , wherein the at least one security performance score includes at least one of: an offline score, a runtime score, and a unified score.