A false positive occurs when an Intrusion Detection System (IDS) incorrectly flags legitimate, benign network traffic or user activity as malicious. In this scenario, the system administrator was performing an authorized and routine task: updating the router's configuration. The IDS, however, misidentified this legitimate administrative action as a potential threat and generated an alert. Since the activity was not an actual attack, but the system generated an alert, it is classified as a false positive. This type of event is common in IDS/IPS tuning, where rules must be refined to distinguish between normal administrative behavior and genuine attacks.

A. False negative: This is the failure of an IDS to detect a real attack. The described event was a legitimate action, not an attack.
B. True negative: This occurs when an IDS correctly identifies benign traffic and does not generate an alert. Here, an alert was generated.
C. True positive: This is the correct identification of a genuine attack. The administrator's action was authorized and not an attack.

1. National Institute of Standards and Technology (NIST) Special Publication 800-94

Guide to Intrusion Detection and Prevention Systems (IDPS)

Revision 1

February 2012.

Section 2.2.2

"IDPS Accuracy

" Page 2-4: Defines a false positive as "Alerts that indicate malicious activity is occurring

but are not caused by actual malicious activity." This directly corresponds to the scenario where a legitimate administrative action triggered an alert.

2. Khraisat

A.

Gondal

I.

Vamplew

P.

& Kamruzzaman

J. (2019). A Survey of Intrusion Detection Systems: Techniques

Datasets and Challenges. Cybersecurity

2(1)

20.

Section "Performance Metrics

" Paragraph 2: The paper defines a False Positive (FP) as "a normal or irrelevant activity that is incorrectly classified as an attack." This aligns with the IDS misclassifying the administrator's legitimate router update.

DOI: https://doi.org/10.1186/s42400-019-0038-7

3. Saltzer

J. H.

& Kaashoek

M. F. (2009). Principles of Computer System Design: An Introduction. MIT OpenCourseWare

Massachusetts Institute of Technology.

Chapter 10

"Security and Protection

" Section 10.5.2

"Intrusion Detection": University courseware on system security design consistently defines these four outcomes (TP

FP

TN

FN) as the fundamental metrics for evaluating any detection system. A false positive is universally described as a "false alarm

" where the system signals an intrusion that has not actually occurred

matching the question's scenario.