What are IDS false positives?

[JoesHO]

I was reading about internet security in lue of all this trojan talk and revelations of people infecting and controlling PC's remotely

and I came across this.

Warning it is in code speak so i am lost could someone translate its merrits and its meaning s for a layman?

http://www.loud-fat-bloke.co.uk/ids-iamdoh.html

[TheEnforcer]

I won't even bother looking as I am sure if it's techie in nature I won't have a clue either!! :lol:

[PornoDoggy]

I'm not a teckie either, so since it's not in proper English I'm not even going to try.




(Note the .uk domain)

[raymor]

IDS = Intrusion Detection System (an alarm system for your server).
False positive = The alarm going off when it shouldn't.

When a legit email ends up in your "spam" box that's a false positive -
the spam filter falsely identified it as a spam. Spam that gets to your
inbox is a false negative - the filter failed to identify an actual spam.
In terms of an IDS, a false negative would be when the system detects
an attack that doesn't exist. Typically itwill then take action to protect
itself from this "attack". it sucks when your mail server protects itself
from you sneidng legit mail through it.

[TheEnforcer]

Ahhh.. ok. Thanks for clarifying.

[*KK*]

You know Joe, it's like when the second pink strip is really, really faint. So you go back to the drugstore, get the one with the plus or minus and it comes up minus ;)

[JoesHO]

Originally posted by raymor@Feb 8 2005, 05:53 PM
IDS = Intrusion Detection System (an alarm system for your server).
False positive = The alarm going off when it shouldn't.

When a legit email ends up in your "spam" box that's a false positive -
the spam filter falsely identified it as a spam. Spam that gets to your
inbox is a false negative - the filter failed to identify an actual spam.
In terms of an IDS, a false negative would be when the system detects
an attack that doesn't exist. Typically itwill then take action to protect
itself from this "attack". it sucks when your mail server protects itself
from you sneidng legit mail through it.
Thank you, Raymor

[JoesHO]

Originally posted by *KK*@Feb 8 2005, 06:00 PM
You know Joe, it's like when the second pink strip is really, really faint. So you go back to the drugstore, get the one with the plus or minus and it comes up minus ;)
Shit, I am still at the part where I don't by Trojans anymore, cause I don't want them to infect my PC

:agrin:

[grimm]

Originally posted by raymor@Feb 8 2005, 05:53 PM
IDS = Intrusion Detection System (an alarm system for your server).
False positive = The alarm going off when it shouldn't.

When a legit email ends up in your "spam" box that's a false positive -
the spam filter falsely identified it as a spam. Spam that gets to your
inbox is a false negative - the filter failed to identify an actual spam.
In terms of an IDS, a false negative would be when the system detects
an attack that doesn't exist. Typically itwill then take action to protect
itself from this "attack". it sucks when your mail server protects itself
from you sneidng legit mail through it.
a false positive is empirical evidence that is contradictory to fact, by definition

[*KK*]

Originally posted by JoesHO1+Feb 8 2005, 07:36 PM--></div><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td>QUOTE (JoesHO1 @ Feb 8 2005, 07:36 PM)</td></tr><tr><td id='QUOTE'> <!--QuoteBegin-*KK*@Feb 8 2005, 06:00 PM
You know Joe, it's like when the second pink strip is really, really faint. So you go back to the drugstore, get the one with the plus or minus and it comes up minus ;)
Shit, I am still at the part where I don't by Trojans anymore, cause I don't want them to infect my PC

:agrin: [/b][/quote]
Yours might not be false, then ;)