Method and system for reducing the false alarm rate of network intrusion detection systems

A method for reducing the false alarm rate of network intrusion detection systems, comprising:

• receiving an alarm indicating a network intrusion may have occurred;
• identifying characteristics of the alarm, including at least an attack type, a source address, a target address, an alarm severity, and an alarm description;
• accessing a storage location;
• determining whether an operating system fingerprint for a target host associated with the target address already exists in the storage location;
• if the operating system fingerprint for the target host does not exist, then:
• querying the target host for the operating system fingerprint;
• receiving the operating system fingerprint that includes the operating system type from the target host;
• comparing the attack type to the operating system type;
• and
• indicating whether the target host is vulnerable to the attack based on the comparison;
• if the operating system fingerprint for the target host does exist, then:
• determining if a cache entry time for the target address is valid;
• and
• if the cache entry time is invalid, then:
• querying the target host for the operating system fingerprint;
• receiving the operating system fingerprint that includes the operating system type from the target host;
• comparing the attack type to the operating system type;
• and
• indicating whether the target host is vulnerable to the attack based on the comparison;
• if the cache entry time is valid, then:
• comparing the attack type to the operating system type;
• and
• indicating whether the target host is vulnerable to the attack based on the comparison.

A system for reducing the false alarm rate of network intrusion detection systems, comprising:

• a network intrusion detection system (NIDS) operable to transmit an alarm indicating an attack on a network may have occurred;
• a software program embodied in a computer readable medium, the software program, when executed by a processor, operable to:
• receive the alarm;
• identify characteristics of the alarm, including at least an attack type and a target address;
• query a target host associated with the target address for an operating system fingerprint;
• receive the operating system fingerprint that includes the operating system type from the target host;
• compare the attack type to the operating system type;
• and
• indicate whether the target host is vulnerable to the attack based on the comparison.

A system for reducing the false alarm rate of network intrusion detection systems, comprising:

• means for receiving an alarm indicating a network intrusion may have occurred;
• means for identifying characteristics of the alarm, including at least an attack type and a target address;
• means for querying a target host associated with the target address for an operating system fingerprint;
• means for receiving the operating system fingerprint that includes the operating system type from the target host;
• means for comparing the attack type to the operating system type;
• and
• means for indicating whether the target host is vulnerable to the attack based on the comparison.