English
Menu

Cyber Attacks and Defense in Practice

An IDS examines 1 million connections a day, of which 100 are actual attacks. The IDS detects 99% of attacks and wrongly judges 0.1% of non-attack connections to be attacks. Which of the following is closest to the proportion of the alerts raised by the IDS that are actual attacks?

  1. AAbout 0.01%
  2. BAbout 9%
  3. CAbout 99%
Show answer and explanation

Answer: B. About 9%

Of the attacks, 100 × 0.99 = 99 are detected, and of the 999,900 non-attack connections, 999,900 × 0.001 = 999.9 (about 1,000) are wrongly alerted. There are about 1,099 alerts in total, of which 99 are attacks, so the proportion is 99 ÷ 1,099 ≈ 0.090, or about 9%. Where attacks are rare, most alerts are false positives even if the false-positive rate is small (the base-rate fallacy). Lowering the false-positive rate to 0.01% reduces the false positives to about 100 and raises the proportion to about 50%, so reducing false positives by tuning detection rules and cross-checking with other information is important for lightening the analysts' load.

  • A. This is the proportion of attacks among all connections (100 ÷ 1 million = 0.01%), not the proportion among alerts.
  • B. Correct. 99 ÷ (99 + 999.9) ≈ 9.0%.
  • C. This is the proportion of attacks detected (the detection rate), which differs from the proportion of alerts that are attacks.
Practice this topic Back to topic

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

More Cyber Attacks and Defense in Practice questions

  1. At a SOC, the SIEM raises 1440 alerts a day, occurring evenly throughout the day. SOAR's automated processing handles 75% of the alerts without analyst review, and each remaining alert needs an average of 10 minutes of analyst work. Assuming analysts can work without breaks, which of the following is the minimum number of analysts who must be on duty at all times to keep up with the rate at which alerts occur?
  2. The Cyber Kill Chain presented by Lockheed Martin in 2011 divides the flow of a targeted attack into seven stages. Which of the following gives the stages in the correct order?
  3. MITRE ATT&CK is a knowledge base that organizes the methods observed in real attacks into "tactics", which represent the attacker's goals, and "techniques", which represent the concrete methods for achieving those goals. Which of the following correctly pairs an observed action with the tactic it falls under?
  4. Which of the following is an "initial access" method, by which an attacker first gets into an organization's network?
  5. An examination of the records of traffic on an internal network found the following traffic. Which of them most strongly suggests that malware is communicating with an external command server (C2 server)?

Comparisons in this topic