Why would anomaly detection IDSs often generate a large number of false positives?

Question

Options

• ABecause they can only identify correctly attacks they already know about.
• BBecause they are application-based are more subject to attacks.
• CBecause they can't identify abnormal behavior.
• DBecause normal patterns of user and system behavior can vary wildly.

• B
  2% (1)
• C
  6% (3)
• D
  92% (45)

Explanation

Anomaly detection IDSs work by establishing a baseline of "normal" behavior and flagging deviations - but legitimate user and system behavior naturally varies (shift changes, software updates, seasonal traffic spikes), causing the system to misclassify normal activity as malicious, generating false positives.

Why the distractors are wrong:

• A describes signature-based IDS, not anomaly detection - that approach can only catch known attacks.
• B is irrelevant; being application-based has no direct bearing on false positive rates.
• C is the opposite of the truth - anomaly detection excels at identifying abnormal behavior; that's its entire mechanism.

Memory tip: Think of anomaly detection as a suspicious neighbor who alerts the police every time someone parks differently. It knows "normal," but normal is never perfectly consistent - so it over-reports. The phrase "wildly varying normal = false alarms" ties the concept together.

No community discussion yet for this question.