Which statement best describes a true positive in IDS alerts?

• A. The IDS labels a behavior as an attack, and it is indeed an attack in real life.
• B. The IDS labels a behavior as not an attack, and it is not an attack in real life.
• C. The IDS labels a behavior as not an attack, but it is an attack in real life.
• D. The IDS labels a behavior as an attack, but it is not an attack in real life.

Answer: (A)

In IDS terminology, a true positive is when the system flags something as an attack and that event is actually an attack in real life. That exactly matches the statement that the IDS labels a behavior as an attack, and it is indeed an attack in real life.

To contrast briefly: if the system flags something as not an attack and it’s harmless, that’s a true negative. If an attack happens but the IDS misses it and labels it as normal, that’s a false negative. If the IDS flags something as an attack but it’s actually benign, that’s a false positive.