Abstract: False positive rate of intrusion detection systems (IDS) affect the detection creditability. Methods to reduce the false positive rate were presented after analyzing creditability of IDS and false positive rate of anomaly IDS. It put methods include the followings; method based on process detection, multi-detection system model. It put emphasis on constructing normal profile dynamically based on artificial immunity to restrain false positive rate, then simulation experiment was done. The results show that the method can improve the detection efficiency and reduce the false positive rate.

Key words: Anomaly intrusion detection, False positive rate, Artificial immunity, Process behaviors