You are an Intrusion Detection Analyst and the system has alerted you to an Event of Interest (EOI) that appears to be activity generated by a worm. You investigate and find that the network traffic w

A false positive occurs when an intrusion detection system fires an alert indicating malicious activity that does not actually exist. In this scenario, the system alerted on traffic resembling a worm signature, but investigation revealed the traffic was entirely normal, meaning the detection was an erroneous alarm with no underlying real threat.

A true negative occurs when no alert fires and no attack is present; this scenario involves an alert that was generated, so it cannot be classified as a true negative.

A true positive requires both an alert firing and a confirmed real attack; since investigation showed normal traffic with no actual worm, the alert does not correspond to a genuine incident.

A false negative occurs when a real attack takes place but the IDS generates no alert; here an alert was generated (even if incorrectly), which is the opposite condition of a false negative.