Signature format
Exact strings, regex, embedding centroids for fuzzy match. Continuously updated from public + private threat intel.
Advertisement
Coverage
Catches known attacks. Zero-day novel attacks miss. Combine with ML classifier for coverage.
Advertisement
False positive control
Signatures tight. Legitimate content shouldn't match. Test on legitimate corpus.