nerdexam
GIAC

GSEC · Question #296

An attacker is able to trick an IDS into ignoring malicious traffic through obfuscation of the packet payload. What type of IDS error has occurred?

The correct answer is D. False Negative. When an IDS is tricked by obfuscation into missing malicious traffic, it has produced a false negative - it failed to detect an attack that actually occurred.

Network Security

Question

An attacker is able to trick an IDS into ignoring malicious traffic through obfuscation of the packet payload. What type of IDS error has occurred?

Options

  • ATrue Negative
  • BTrue Positive
  • CFalse Positive
  • DFalse Negative

How the community answered

(18 responses)
  • A
    6% (1)
  • B
    17% (3)
  • C
    6% (1)
  • D
    72% (13)

Why each option

When an IDS is tricked by obfuscation into missing malicious traffic, it has produced a false negative - it failed to detect an attack that actually occurred.

ATrue Negative

A true negative means no attack occurred and the IDS correctly produced no alert, which is the normal benign-traffic scenario.

BTrue Positive

A true positive means an attack occurred and the IDS correctly detected and alerted on it, the opposite of what happened here.

CFalse Positive

A false positive means the IDS incorrectly flagged benign traffic as malicious, whereas here the IDS incorrectly cleared actual malicious traffic.

DFalse NegativeCorrect

A false negative occurs when malicious activity is present but the detection system does not raise an alert. By obfuscating the payload, the attacker caused the IDS to treat the malicious traffic as benign, meaning the system returned a 'not malicious' verdict on traffic that was, in fact, malicious - the classic definition of a false negative.

Concept tested: IDS detection accuracy - false negative identification

Source: https://csrc.nist.gov/glossary/term/false_negative

Topics

#IDS#false negative#evasion techniques#obfuscation

Community Discussion

No community discussion yet for this question.

Full GSEC Practice