19: Writing high-quality IDS detection rules ft. Eindhoven University of Technology on Studio 471
Studio 471Show Notes
Security operations centers, or SOCs, are a core defensive component for organizations. Quickly processing alerts can give a clue if an organization is under attack. But the volume and quality of alerts can greatly vary depending on how well the detection rules have been written. Some rules may return too many low-quality alerts, which can distract analysts from more important ones. Luca Allodi and Koen Teuwen of Eindhoven University of Technology co-authored a recent academic study that examines how to write lower-noise rules for intrusion detection systems (IDSs). The researchers developed six design principles for rule writing that balance specificity with coverage. The aim is to help analysts make better sense of what’s going on in their networks. The research also resulted in the development of a command-line tool, suricata-check, which gives feedback on how a rule written for the Suricata open-source IDS can be improved. Participants: Luca Allodi, Associate Professor and head of the Threat Analysis group within the Security Cluster of the Eindhoven University of Technology Koen Teuwen, PhD Candidate at Eindhoven University of Technology Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471 ---------- Stay in Touch!
Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/
More from Studio 471
Many countries have retired checks as a financial instrument, but billions of checks are still written every year in the U.S. This has proved to be a boon to fraudsters. There is an entire underground industry dedicated to stealing and fabricating checks that is not slowing down and is tricky to combat. Often, images of stolen checks are posted on Telegram and offered for sale to other fraudsters. In this Studio 471, Eric Huber, who is Cybercrime Research Leader at TD Bank, discusses why check fraud is such a huge problem and how financial institutions can counter it. Huber is the curator of the Fraudster Glossary, which is an index of terms used on cybercrime forums. Participants: Eric Huber, Cybercrime Research Leader, TD Bank Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471 ---------- Stay in Touch!
Cyber deception involves various techniques to manipulate adversaries, whether it’s baiting them with fake resources or trapping them in frustrating loops. Tim Pappa is a former FBI supervisory special agent who specializes in deception techniques. In this Studio 471, Tim discusses what kinds of threat intelligence can be gained from deception techniques, its limitations, the Bell-Whaley framework and how organizations can start their own scalable deception programs. Participants: Tim Pappa, Incident Response Engineer - Cyber Deception Strategy, Content Development and Marketing, Walmart Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471 ---------- Stay in Touch!
Over last several years, clusters of English-speaking threat actors have conducted data breaches on a wide scale. These groups come from an online community known as Com or Community. In the beginning, these threat actors mostly focused mostly on harassing each other, stealing short usernames, cryptocurrency and cheating at games. But then they transitioned into serious data theft, extortion and ransomware. They’ve been intensely investigated by private companies and law enforcement, which have collaborated together to uncover some of their real-world identities and resulted in arrests. In this Studio 471, Michael Fletcher, a former Cybercrime Technical Analyst with the Australian Federal Police, describes the origins of The Com, the tactics used by these threat actors and why they pose a threat to organizations. Participants: Michael Fletcher, former Cybercrime Technical Analyst, Australian Federal Police Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471 ---------- Stay in Touch!
Telegram has emerged as a significant platform for cybercriminal activity. Threat actors offer goods and services ranging from payment card details to login credentials to malware and other hacking tools. This ecosystem is vast, and it’s challenging to track. Sayak Saha Roy is an assistant professor at Louisiana State University working on online fraud prevention and usable security. He and several colleagues presented a paper at the Usenix Security Symposium in August 2025 titled “DarkGram: A Large-Scale Analysis of Cybercriminal Activity Channels on Telegram.” The paper describes how the researchers used a language model to identify cybercrime-related posts on Telegram channels with a high degree of accuracy. In this Studio 471, Roy describes how it can be used for cyber threat intelligence research, moderation and more. Participants: Sayak Saha Roy, Assistant Professor at Louisiana State University, Online Fraud Prevention and Usable Security Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471 ---------- Stay in Touch!
Structuring a cyber threat intelligence (CTI) program differs for every organization depending on size, the assets it is trying to protect and the threat landscape affecting their particular industry. Kobe Shwartz is the Head of Cyber Threat Intelligence and Analysis at Signify and is also the founder of a consultancy, Underdark.ai. He was formerly a Russian cybercrime and espionage analyst in the Israeli government. In this Studio 471, Shwartz discusses how he started the CTI team at Signify, which was formerly known as Philips Lighting. He also discusses how to manage alert overload, the importance of “Dark Web” intelligence and how to measure return on investment in a CTI program. Participants: Kobe Shwartz, Head, Cyber Threat Intelligence and Analysis, Signify Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471 ---------- Stay in Touch!