Patent ID: 9398040
Filing Date: 2016-07-19
CPC Classification: H04L

Claim Text:
1. An Intrusion Detection System (IDS) false positive detection apparatus, comprising: at least one hardware processor and a storage, a payload extractor which is executed by the at least one hardware processor and extracts each payload by dividing each packet corresponding to an IDS detection rule into a header and a payload; a false positive payload information generator which is executed by the at least one hardware processor and generates false positive payload information required to identify a false positive payload by extracting a payload of a false positive packet based on results of packet analysis received from a manager; and a false positive payload determinator which is executed by the at least one hardware processor and transmits results of a determination of whether the each payload extracted by the payload extractor corresponds to a false positive payload, based on the false positive payload information, to the manager, wherein the false positive payload determinator is configured to: compare the false positive payload information with the each payload extracted by the payload extractor, if the false positive payload information matches the each extracted payload, determine that the each extracted payload is a false positive payload, and if the false positive payload information does not match the each extracted payload, determine that the each extracted payload is a suspected true positive payload, thus classifying the each extracted payload, and wherein the false positive payload determinator comprises a transmission unit for transmitting the detection rule, the header of the packet, and the false positive payload and the suspected true positive payload classified by a payload classifier to the manager.