Patent ID: 9275224
Filing Date: 2016-03-01
CPC Classification: G06F,H04L

Claim Text:
1. An apparatus for improving detection performance of an intrusion detection system, comprising: a transformed detected data generator implemented in a hardware processor, which changes pieces of original detected data, detected based on current detection rules, to pieces of transformed detected data complying with a transformed detected data standard; a transformed detected data classifier implemented in a hardware processor, which classifies the pieces of transformed detected data by attack type, classifies pieces of transformed detected data for respective attack types by current detection rule, and classifies pieces of transformed detected data for respective detection rules into true positives/false positives; a transformed keyword tree generator implemented in a hardware processor, which generates a true positive transformed keyword tree and a false positive transformed keyword tree, based on results of classification by the transformed detected data classifier; a true positive path identifier implemented in a hardware processor, which generates a true positive node by comparing the true positive transformed keyword tree with the false positive transformed keyword tree, and identifies a true positive path connecting a base node to the true positive node in the true positive transformed keyword tree; and a true positive detection pattern generator implemented in a hardware processor, which generates a true positive detection pattern based on the identified true positive path.