In IDS evaluation, which statement describes a True Negative?

In IDS evaluation, which statement describes a True Negative?

• A. The IDS incorrectly flags an attack as non-attack.
• B. The IDS correctly flags an attack as an attack.
• C. The IDS correctly flags non-attack as non-attack.
• D. The IDS incorrectly flags non-attack as attack.

Answer: (C)

In IDS evaluation, outcomes are described as true positives, false positives, true negatives, and false negatives. A true negative is when there is no attack and the IDS correctly does not raise an alert—non-attack is recognized as non-attack. This is the best description because it shows the system is accurately distinguishing benign activity from malicious activity, which helps prevent unnecessary alerts and analyst fatigue. The other scenarios map to the opposite outcomes: an attack present but not detected is a false negative, an attack correctly detected is a true positive, and benign activity flagged as an attack is a false positive.

In IDS evaluation, outcomes are described as true positives, false positives, true negatives, and false negatives. A true negative is when there is no attack and the IDS correctly does not raise an alert—non-attack is recognized as non-attack. This is the best description because it shows the system is accurately distinguishing benign activity from malicious activity, which helps prevent unnecessary alerts and analyst fatigue. The other scenarios map to the opposite outcomes: an attack present but not detected is a false negative, an attack correctly detected is a true positive, and benign activity flagged as an attack is a false positive.