An Intrusion detection system (IDS) is a network security device that monitors network and/or system activities for malicious or unwanted behavior.

IDS Terminology

Alert/Alarm- A signal suggesting that a system has been or is being attacked .

True attack stimulus- An event that triggers an IDS to produce an alarm and react as though a real attack were in progress .

False attack stimulus- The event signaling an IDS to produce an alarm when no attack has taken place .

False (False Positive)- An alert or alarm that is triggered when no actual attack has taken place .

False negative- A failure of an IDS to detect an actual attack .

Noise- Data or interference that can trigger a false positive .

Site policy- Guidelines within an organization that control the rules and configurations of an IDS .

Site policy awareness- The ability an IDS has to dynamically change its rules and configurations in response to changing environmental activity .

Confidence value- A value an organization places on an IDS based on past performance and analysis to help determine its ability to effectively identify an attack .

Alarm filtering- The process of categorizing attack alerts produced from an IDS in order to distinguish false positives from actual attacks .