Patent ID: 8806628

Claim:
A system comprising: a non-transitory computer readable storage medium for storing at least one alert database and at least one associated signature set to each alert database; an analytics module in communication to said computer readable storage medium, said analytics module analyzes at least one alert database present on said computer storage medium to determine whether any signatures from the signature set associated with the alert database being analyzed are ineffective based at least on a ratio of valid alerts to false positive alerts for individual signatures selected from a group including a plurality of signatures present in the signature set; and an adjustment module in communication to said computer readable storage medium and said analytics module, said adjustment module removes at least one ineffective signature from the signature set, wherein said analytics module determines whether one signature is ineffective by quantifying each signature having the ratio less than a quantification threshold by: removing iteratively from the signature set each signature having the ratio less than the quantification threshold, applying the modified signature set against the packets present in the alerts database, and determining at least one attribute for the removed signature.