System and method for reducing false positives during detection of network attacks

A computer implemented method for reducing false positives during detection of network attacks on a protected computer, the method comprising:

• receiving at a proxy device network traffic directed to the protected computer;
• redirecting by the proxy device the received network traffic to a filtering center;
• mirroring by the proxy device the received network traffic to a traffic sensor;
• analyzing the mirrored network traffic by the traffic sensor and collecting statistical information about the mirrored network traffic;
• aggregating information collected by the traffic sensor and generating, based on the aggregated information, traffic filtering rules for detecting network attacks on the protected computer;
• filtering, in parallel with collection of the statistical information from the mirrored traffic by the traffic sensor, the redirected traffic by the filtering center using the generated filtering rules;
• and
• correcting the filtering rules by a control module based on statistical information about known network attacks for purpose of reducing false positives during detection of network attacks on the protected computer.

A computer program product embedded in a non-transitory computer-readable storage medium, the computer-readable storage medium comprising computer-executable instructions for reducing false positives during detection of network attacks on a protected computer, the medium includes instructions for:

• receiving at a proxy device network traffic directed to the protected computer;
• redirecting by the proxy device the received network traffic to a filtering center;
• mirroring by the proxy device the received network traffic to a traffic sensor;
• analyzing the mirrored network traffic by the traffic sensor and collecting statistical information about the mirrored network traffic;
• aggregating information collected by the traffic sensor and generating, based on the aggregated information, traffic filtering rules for detecting network attacks on the protected computer;
• filtering, in parallel with collection of the statistical information from the mirrored traffic by the traffic sensor, the redirected traffic by the filtering center using the generated filtering rules;
• and
• correcting the filtering rules by a control module based on statistical information about known network attacks for purpose of reducing false positives during detection of network attacks on the protected computer.