Inspecting Intrusion Prevention System Signatures for False Blocking using Set Theory

A network intrusion prevention system (NIPS) is a network security application that detects and blocks cyber-attacks to protect information assets. However, it sometimes generates false positives during its blocking mode operation, which leads to blocking legitimate user inputs and reducing service availability. Thus, such false blockings need to be reduced. Machine learning methods for reducing false positives or NIPS evaluation methods for detecting NIPS signatures that cause false blockings have been proposed, but they do not always remove all false blockings. We propose a method using set theory to detect all signatures that cause false blockings. The method checks whether a set of user inputs representing as a regular expression and a set of signatures are mutually exclusive in set theory. Therefore, false blockings are eliminated by tuning the signatures judged as not mutually exclusive with the proposed method. We implemented and evaluated the proposed method, and results indicate that it not only detected all imperfect signatures but was also executed faster than a conventional method.