Question

4. If an IDS system produces a lot of false-positive alarms or a lot of false-negative alarms, what do you suppose it happens and how would you suggest to fix it? 5. Is it possible for an IDS system to produce a lot of false-positive and false-negative alarms in a short period of time and why? I

Answer 1

Answer 1)

IDS is defined as the Intrusion Detection System which is used to monitor the traffic in the network and then produces alarm when it notices suspicious activity which can be a attack. IDS can only alert the admin by giving alarm but have no mechanism to prevent the attack.

The IDS system produces a number a lot of false-positive alarms or false-negative alarm becuase IDS cannot detect intrusion with 100% accuracy. The accuracy of IDS system defined how much accurately it can classify different activities as suspicious or not. But it is very difficult to build 100% accurate IDS and thus it gives false-positive and false-negative alarms.

In order to solve this problem a new technique that is Data Mining has proved an effective method which classifies serious alerts and irrelevent alerts with an accruracy of 99.9%. Data Mining works by discovering patterns to classify an activity as suspicious or not. The results have shown that data mining reduces the number of false-positive and false-negative and increases the accuracy of the system.