IDS/IPS - True/False Positive/Negative

In the context of Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS), the terms "true negative," "false negative," "true positive," and "false positive" are used to describe the accuracy and effectiveness of the system in detecting malicious activities.

1. True Negative (TN):

   • Definition: When the IDS/IPS correctly identifies legitimate (non-malicious) activity as non-malicious.

   • Example: Normal network traffic is correctly identified as benign.

2. False Negative (FN):

   • Definition: When the IDS/IPS fails to identify malicious activity, allowing it to go undetected.

   • Example: A malware attack occurs, but the IDS/IPS does not detect it, and it passes through as normal traffic.

3. True Positive (TP):

   • Definition: When the IDS/IPS correctly identifies and flags malicious activity.

   • Example: An attempted SQL injection attack is detected and flagged by the IDS/IPS.

4. False Positive (FP):

   • Definition: When the IDS/IPS incorrectly identifies legitimate activity as malicious.

   • Example: Normal user behavior is flagged as suspicious by the IDS/IPS, causing an alert.

Here's a table to summarize these concepts:

	Actual Malicious Activity	Actual Legitimate Activity
Detected as Malicious	True Positive (TP)	False Positive (FP)
Detected as Legitimate	False Negative (FN)	True Negative (TN)

Understanding these terms is crucial for evaluating the performance and reliability of an IDS/IPS, as high rates of false positives can lead to alert fatigue, while high rates of false negatives can leave the network vulnerable to undetected attacks.