Method and system for reducing the false alarm rate of network intrusion detection systems

1. A method for reducing the false alarm rate of network intrusion detection systems, comprising:

receiving an alarm indicating a network intrusion may have occurred;

identifying characteristics of the alarm, including at least an attack type, a source address, a target address, an alarm severity, and an alarm description;

accessing a storage location;

determining whether an operating system fingerprint for a target host associated with the target address already exists in the storage location;

if the operating system fingerprint for the target host does not exist, then:

querying the target host for the operating system fingerprint;

receiving the operating system fingerprint that includes the operating system type from the target host;

comparing the attack type to the operating system type; and

indicating whether the target host is vulnerable to the attack based on the comparison;

if the operating system fingerprint for the target host does exist, then:

determining if a cache entry time for the target address is valid; and

if the cache entry time is invalid, then:

querying the target host for the operating system fingerprint;

receiving the operating system fingerprint that includes the operating system type from the target host;

comparing the attack type to the operating system type; and

indicating whether the target host is vulnerable to the attack based on the comparison;

if the cache entry time is valid, then:

comparing the attack type to the operating system type; and

indicating whether the target host is vulnerable to the attack based on the comparison.

2. The method of claim 1 , further comprising storing the operating system fingerprint of the target host in the storage location for a time period.

3. The method of claim , further comprising:

monitoring a dynamic configuration protocol server;

detecting that a lease issue has occurred for a new target host;

querying the new target host for a new operating system fingerprint;

receiving the new operating system fingerprint from the new target host; and

storing the new operating system fingerprint of the new target host in the storage location for a length of time.

4. The method of claim 1 , further comprising:

monitoring a dynamic configuration protocol server;

detecting that a lease expire has occurred for an existing target host;

accessing the storage location; and

purging the existing operating system fingerprint for the existing target host from the storage location.

5. A computer-readable non-transitory storage medium embodying software this is operable when executed by a computer system to:

receive an alarm indicating a network intrusion may have occurred;

identify characteristics of the alarm, including at least an attack type, a source address, a target address, an alarm severity, and an alarm description;

access a storage location;

determine whether an operating system fingerprint for a target host associated with the target address already exists in the storage location;

if the operating system fingerprint for the target host does not exist, then:

query the target host for the operating system fingerprint;

receive the operating system fingerprint that includes the operating system type from the target host;

compare the attack type to the operating system type; and

indicate whether the target host is vulnerable to the attack based on the comparison;

if the operating system fingerprint for the target host does exist, then:

determine if a cache entry time for the target address is valid; and

if the cache entry time is invalid, then:

query the target host for the operating system fingerprint;

receive the operating system fingerprint that includes the operating system type from the target host;

compare the attack type to the operating system type; and

indicate whether the target host is vulnerable to the attack based on the comparison;

if the cache entry time is valid, then:

compare the attack type to the operating system type; and

indicate whether the target host is vulnerable to the attack based on the comparison.

6. The medium of claim 5 , wherein the software is further operable to store the operating system fingerprint of the target host in the storage location for a time period.

7. The medium of claim 5 , wherein the software is further operable to:

monitor a dynamic configuration protocol server;

detect that a lease issue has occurred for a new target host;

query the new target host for a new operating system fingerprint;

receive the new operating system fingerprint from the new target host; and

store the new operating system fingerprint of the new target host in the storage location for a length of time.

8. The medium of claim 6 , wherein the software is further operable to:

monitor a dynamic configuration protocol server;

detect that a lease expire has occurred for an existing target host;

access the storage location; and

purge the existing operating system fingerprint for the existing target host from the storage location.

9. An apparatus comprising:

a communication interface;

memory containing instructions for execution by a processor; and

the processor, operable when executing the instructions to:

receive an alarm indicating a network intrusion may have occurred;

identify characteristics of the alarm, including at least an attack type, a source address, a target address, an alarm severity, and an alarm description;

access a storage location;

determine whether an operating system fingerprint for a target host associated with the target address already exists in the storage location;

if the operating system fingerprint for the target host does not exist, then:

query the target host for the operating system fingerprint;

receive the operating system fingerprint that includes the operating system type from the target host;

compare the attack type to the operating system type; and

indicate whether the target host is vulnerable to the attack based on the comparison;

if the operating system fingerprint for the target host does exist, then:

determine if a cache entry time for the target address is valid; and

if the cache entry time is invalid, then:

query the target host for the operating system fingerprint;

receive the operating system fingerprint that includes the operating system type from the target host;

compare the attack type to the operating system type; and

indicate whether the target host is vulnerable to the attack based on the comparison;

if the cache entry time is valid, then:

compare the attack type to the operating system type; and

indicate whether the target host is vulnerable to the attack based on the comparison.

10. The apparatus of claim 9 , wherein the processor is further operable to store the operating system fingerprint of the target host in the storage location for a time period.

11. The apparatus of claim 9 , wherein the processor is further operable to:

monitor a dynamic configuration protocol server;

detect that a lease issue has occurred for a new target host;

query the new target host for a new operating system fingerprint;

receive the new operating system fingerprint from the new target host; and

store the new operating system fingerprint of the new target host in the storage location for a length of time.

12. The apparatus of claim 9 , wherein the processor is further operable to:

monitor a dynamic configuration protocol server;

detect that a lease expire has occurred for an existing target host;

access the storage location; and

purge the existing operating system fingerprint for the existing target host from the storage location.