What is the definition of a false positive in IDS alerts?

• A. The IDS labels a benign behavior as an attack, but it is not an attack in real life.
• B. The IDS labels a behavior as an attack, but it is not an attack in real life.
• C. The IDS labels a behavior as not an attack, but it is an attack in real life.
• D. The IDS labels a behavior as an attack, and it is indeed an attack in real life.

Answer: (A)

False positives happen when the IDS flags something as malicious even though it isn’t actually an attack. The described scenario fits this: harmless or benign activity is labeled as an attack, even though no real threat exists. This differs from a true positive, where a real attack is correctly detected, and from a false negative, where an actual attack goes undetected. It also differs from a true negative, where benign activity is correctly not flagged. False positives can waste time and resources and contribute to alert fatigue, which is why tuning and filtering are important.