Adam always reads his e-mails on Sundays around 5 pm. This Saturday, at 11 am, he accessed his inbox. Which will generate a false positive?

Source slide 10/41

Misuse-based IDS or anomaly-based IDS? IMO the answer should be anomaly-based IDS as it gives alerts on anomalies. Whereas misuse-based or signature-based IDS compares it with known attacks, and accessing email at a different time might not be a known attack.

  • 2
    Ok, in English, that's known as a "false positive". They use that term later in that document. It's an alert where there is nothing wrong. It gets tricky when it's anomaly-based.
    – schroeder
    Aug 29, 2021 at 10:54

1 Answer 1


You are correct.

A signature-based system might not detect that event as malicious since it is a legitimate use of the email system. It would not alert at all.

An anomaly-based system might see the unusual connection and alert.

However, whether or not this is "false" requires a bit of philosophy. It is an anomaly. It's just not malicious since the scenario says that we know that the legitimate user accessed the system. So it might not be an alert we want to or need to see.

In many contexts, if someone accessed the email system outside of the normal window, security teams would want to be alerted in order to confirm that the access was malicious or not.

So, the question of whether or not this is "false" is not the right question to ask. It's a true anomaly. It's just not malicious activity only because we know that the legitimate user enagaged in the authorised activity.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .