Which term describes an attack that is not detected by the IDS, resulting in no alert?

Which term describes an attack that is not detected by the IDS, resulting in no alert?

• A. True Positive
• B. False Positive
• C. False Negative
• D. True Negative

Answer: (C)

When an attack happens but the IDS does not detect it and no alert is generated, the situation is a false negative. This term describes a mismatch between the actual event (an attack occurring) and the IDS output (no alert). Think of the ground truth as “was there an attack?” If the answer is yes and the IDS also raises an alert, that’s a true positive. If there’s an alert when there isn’t an attack, that’s a false positive. If there’s no attack and no alert, that’s a true negative. A false negative, therefore, is harmful because the attack slips by without warning, allowing it to progress undetected. For example, a zero-day exploit or encrypted traffic that the IDS isn’t inspecting might fire a false negative. To reduce this risk, analysts tune detection rules, incorporate anomaly-based detection, and correlate data from multiple sources to improve recall, which measures how many actual attacks are caught.

When an attack happens but the IDS does not detect it and no alert is generated, the situation is a false negative. This term describes a mismatch between the actual event (an attack occurring) and the IDS output (no alert). Think of the ground truth as “was there an attack?” If the answer is yes and the IDS also raises an alert, that’s a true positive. If there’s an alert when there isn’t an attack, that’s a false positive. If there’s no attack and no alert, that’s a true negative. A false negative, therefore, is harmful because the attack slips by without warning, allowing it to progress undetected. For example, a zero-day exploit or encrypted traffic that the IDS isn’t inspecting might fire a false negative. To reduce this risk, analysts tune detection rules, incorporate anomaly-based detection, and correlate data from multiple sources to improve recall, which measures how many actual attacks are caught.