The Exclusion Ratchet: False-Positive Suppression Accumulates and Persists in Detection Rule Repositories
[Kryptografia i bezpieczeństwo] Autorzy: Sudaroli Dhananjeyan, Kumaran U
When a rule produces too many false alarms an analyst adds an exclusion, and the rule thereafter declines to alert in that circumstance. Each such decision is locally reasonable; what becomes of them collectively is not known. Recent longitudinal work established that curation does not converge, but measured restoration time only for revisions that were later reverted -- a measure silent about narrowing that is never undone. We measure that. Across nine years and 8,234 revisions of the SigmaHQ corpus we detect suppression semantically -- growth in the set of predicates held under negation without compensating growth in coverage -- and validate it against blinded hand labelling (precision 0.828, recall 0.911). The test is deterministic: nothing is learned from the data, and the definitions are released as code. Exclusions were added 1,642 times and withdrawn 304, a ratio of 5.4 to 1 that…
- Kategoria arxiv
- cs.CR
- Kategoria
- Kryptografia i bezpieczeństwo