GSEC · Question #296
An attacker is able to trick an IDS into ignoring malicious traffic through obfuscation of the packet payload. What type of IDS error has occurred?
The correct answer is D. False Negative. When an IDS is tricked by obfuscation into missing malicious traffic, it has produced a false negative - it failed to detect an attack that actually occurred.
Question
An attacker is able to trick an IDS into ignoring malicious traffic through obfuscation of the packet payload. What type of IDS error has occurred?
Options
- ATrue Negative
- BTrue Positive
- CFalse Positive
- DFalse Negative
How the community answered
(18 responses)- A6% (1)
- B17% (3)
- C6% (1)
- D72% (13)
Why each option
When an IDS is tricked by obfuscation into missing malicious traffic, it has produced a false negative - it failed to detect an attack that actually occurred.
A true negative means no attack occurred and the IDS correctly produced no alert, which is the normal benign-traffic scenario.
A true positive means an attack occurred and the IDS correctly detected and alerted on it, the opposite of what happened here.
A false positive means the IDS incorrectly flagged benign traffic as malicious, whereas here the IDS incorrectly cleared actual malicious traffic.
A false negative occurs when malicious activity is present but the detection system does not raise an alert. By obfuscating the payload, the attacker caused the IDS to treat the malicious traffic as benign, meaning the system returned a 'not malicious' verdict on traffic that was, in fact, malicious - the classic definition of a false negative.
Concept tested: IDS detection accuracy - false negative identification
Source: https://csrc.nist.gov/glossary/term/false_negative
Topics
Community Discussion
No community discussion yet for this question.