What term describes when an intrusion detection system correctly classifies normal activity as acceptable?

What term describes when an intrusion detection system correctly classifies normal activity as acceptable?

• A. False Negative
• B. True Negative
• C. Bastion Host
• D. Demilitarized Zone (DMZ)

Answer: (B)

When an intrusion detection system processes activity, its results fall into true positives, false positives, true negatives, or false negatives. The scenario described—normal, non-threatening activity being labeled as acceptable—is a true negative. It means the system correctly recognizes that there is no threat and does not raise an alarm. This differs from a false negative, where malicious activity goes undetected and is wrongly classified as normal, which is a missed detection. It also differs from a false positive, where normal activity is incorrectly flagged as malicious, causing an unnecessary alert. Bastion Host and DMZ are network design concepts and not about how the IDS classifies activity.

When an intrusion detection system processes activity, its results fall into true positives, false positives, true negatives, or false negatives. The scenario described—normal, non-threatening activity being labeled as acceptable—is a true negative. It means the system correctly recognizes that there is no threat and does not raise an alarm.

This differs from a false negative, where malicious activity goes undetected and is wrongly classified as normal, which is a missed detection. It also differs from a false positive, where normal activity is incorrectly flagged as malicious, causing an unnecessary alert. Bastion Host and DMZ are network design concepts and not about how the IDS classifies activity.