Patent ID: 8151341

Claim:
A system for reduction of false positives during detection of network attacks on a protected computer, the system comprising: a proxy device configured to receive network traffic directed to a protected computer, redirect the received traffic to a filtering center and mirror the received traffic to a traffic sensor; the traffic sensor configured to collect statistical information about the mirrored traffic; a data collector configured to aggregate information collected by the traffic sensor and generate, based on the aggregated information, traffic filtering rules for detecting network attacks on the protected computer; the filtering center configured to, in parallel with collection of the statistical information from the mirrored traffic by the traffic sensor and based on the traffic filtering rules provided by the data collector, detect, in the redirected traffic, network attacks on the protected computer and filter out from the redirected traffic network traffic associated with the detected network attacks; and a control module configured to collect and store statistical information about known network attacks and to correct the traffic filtering rules used by the filtering center for purpose of reducing false positives during detection of network attacks on the protected computer.