Patent ID: 7886357

Claim:
A method for reducing the false alarm rate of network intrusion detection systems, comprising: receiving an alarm indicating a network intrusion may have occurred; identifying characteristics of the alarm, including at least an attack type, a source address, a target address, an alarm severity, and an alarm description; accessing a storage location; determining whether an operating system fingerprint for a target host associated with the target address already exists in the storage location; if the operating system fingerprint for the target host does not exist, then: querying the target host for the operating system fingerprint; receiving the operating system fingerprint that includes the operating system type from the target host; comparing the attack type to the operating system type; and indicating whether the target host is vulnerable to the attack based on the comparison; if the operating system fingerprint for the target host does exist, then: determining if a cache entry time for the target address is valid; and if the cache entry time is invalid, then: querying the target host for the operating system fingerprint; receiving the operating system fingerprint that includes the operating system type from the target host; comparing the attack type to the operating system type; and indicating whether the target host is vulnerable to the attack based on the comparison; if the cache entry time is valid, then: comparing the attack type to the operating system type; and indicating whether the target host is vulnerable to the attack based on the comparison.