## 6 Method for Reducing the False Alarm Rate
\begin{table}
\begin{tabular}{l l l} \hline \hline
**SID** & **freq.** & **DESCRIPTION** \\ \hline
1852 & 53738 & SERVER-WEBAPF robots.txt access \\ \hline
41742 & 16182 & POLICY-OTHER external admin access attempt \\ \hline
17410 & 12643 & OS-WINDOWS Generic HyperLink buffer overflow attempt \\ \hline
1122 & 834 & SERVER-WEBAPP/etc./passwd file access attempt \\ \hline
23362 & 707 & SERVER-IIS tilde character file name discovery attempt-sid: 23362] \\ \hline
13990 & 381 & SQL union select-possible sql injection attempt-GET parameter \\ \hline
20528 & 245 & SERVER-APACHE Apache mod_proxy reverse proxy information disclosure attempt-sid: 20528] \\ \hline
1070 & 197 & SERVER-WEBAPP WebDAV search access-sid: 1070] \\ \hline
2056 & 134 & SERVER-WEBAPP TRACE attempt-sid: 2056] \\ \hline
17609 & 128 & SERVER-WEBAPP Oracle Java Web Server WebDAV Stack Buffer Overflow attempt-sid: 17609] \\ \hline \hline \end{tabular}
\end{table} 
Table 7: SID and frequency of alerts (top-10). Figure 4: Histogram sorted to rank (log scale). ```
Input:\(\mathcal{S}\) set of rules (SID) in the histogram, \(\mathcal{A}(\mathcal{S})\) set of alerts generated by \(\mathcal{S}\), \(\Phi\) lower limit of target precision Output:\(\mathcal{R}\) set of rules to deactivate, \(\delta\) minimum precision achieved
1\(TP=0\); \(\mathcal{R}=\varnothing\);
2 foreach rule s in \(\mathcal{S}\)do /* calculate global precision */ \(\delta=TP/|A(\mathcal{S}-\mathcal{R})|\); if\(\delta<\Phi\)then /* different alerts generated by s */ \(\mathcal{A}^{\prime}\)= suppress duplicated alerts in \(\mathcal{A}(s)\); /* sort URIs in \(\mathcal{A}^{\prime}\) lexicographically */ \(\mathcal{A}^{\prime\prime}=sort(\mathcal{A}^{\prime})\); /* identify patterns in \(\mathcal{A}\) */ \(\mathcal{P}\) = patterns found by inspection in \(\mathcal{A}^{\prime\prime}\); forach\(p\in\mathcal{P}\) and each unpatterned URI\(\in\mathcal{A}^{\prime\prime}\)do
3 review to classify as TP or FP;
4
5 end if /* if precision of s does not meet target precision, suppress the rule */
6 if(\(TP(s)/\mathcal{A}(s)<\Phi\))then /* include s to be deactivated */
7\(\mathcal{R}=\mathcal{R}\cup s\);
8 else /* add the \(TP\) found in \(\mathcal{A}(s)\) to overall TP count */ \(TP=TP+TP(s)\);
9
10 end if
11
12 end for
```  
**Algorithm 1**Algorithm for the selection of rules to be deactivated  
The algorithm starts by initializing the number of \(TP\) to 0 so that the initial precision is 0. Basically, the algorithm evaluates the number of \(TP\) and \(FP\) scored by the first rule. If the rule fails to meet the target precision, it is deactivated and the next rule is processed. This continues until the target precision is achieved. For each rule, our algorithm makes the following:  
* Delete duplicated URIs in the alerts generated by the rule. This notably reduces the number of alerts to examine. For instance, after suppressing duplicated alerts triggered by the top rule (SID = 1852), 53,738 attacks (URIs) were reduced to only 8. * Sort the resulting URIs in lexicographic order to facilitate the identification of patterns (i.e., a regular expression common to a set of URIs). For example, URIs that are similar in path and attributes but contain different values in the query will be arranged consecutively. * Identification of patterns. Note that not all URIs will follow a pattern, but, in our experience, they do to a large extent. Patterns severely reduce the time spent for manual inspection. * Manually discern \(TP\) and \(FP\) in the patterns discovered and unpatterned URIs. The decision made for a pattern will be extended to all the URIs that follow that pattern. The decision made for a URI will be also applied to duplicates URIs. * After the manual classification of the URIs/patterns triggered by the rule, the precision is calculated (\(TP/(TP+FP)\)). If the rule does not reach the target precision, \(\Phi\), it should be deactivated. Otherwise, the rule is included in the final ruleset, and the number of TP is updated to calculate the overall precision of the active ruleset (\(A(S-R)\)).