What is the difference between a false positive and false negative in IDS?

  • A false positive is considered to be a false alarm and false negative is considered to be the most complicated state.
  • A false positive occurs when an IDS fires an alarm for legitimate network activity.
  • A false negative occurs when IDS fails to identify malicious network traffic.

Compared to both, a false positive is more acceptable than false negative as they lead to intrusions without getting noticed.