What is the definition of a false negative in IDS alerts?

• A. The IDS labels a not an attack, but it is an attack in real life.
• B. The IDS labels a behavior as an attack, but it is not an attack in real life.
• C. The IDS labels a behavior as an attack, which is indeed an attack in real life.
• D. The IDS labels a not an attack, and it is not an attack in real life.

Answer: (A)

A false negative occurs when the IDS misses an actual attack and does not raise an alert, effectively labeling malicious activity as normal. In other words, real attack activity exists, but the system indicates there’s no threat. That matches the statement that the IDS labels something as not an attack even though it is an attack in real life.

To contrast briefly: a false positive would flag something as an attack when there isn’t one, a true positive would correctly flag an actual attack, and a true negative would correctly not flag normal, non-malicious activity.