What does True Negative indicate in IDS alerts?

• A. The IDS labels a behavior as not an attack, but it is not an attack in real life.
• B. The IDS labels a behavior as an attack, and it is not an attack in real life.
• C. The IDS labels a behavior as not an attack, but it is an attack in real life.
• D. The IDS labels a behavior as an attack, which is indeed an attack in real life.

Answer: (A)

In intrusion detection system terminology, a true negative happens when there is no real attack and the IDS correctly does not raise an alert. The option describes the system labeling a behavior as not an attack, and that this behavior is not an attack in real life—matching a benign event that the IDS handles correctly. This is exactly how true negatives are characterized: expected benign activity passing without an alert.

To place it in the broader context, other scenarios cover the rest of the possibilities in the detection outcomes: flagging something as an attack when it isn’t (false positive), missing an actual attack (false negative), and correctly flagging an actual attack (true positive).