George is responsible for setting and tuning the thresholds for his companysbehavior-based IDS. Which of the following outlines the possibilities of not doingthis activity properly?
A.
If the threshold is set too low, non-intrusive activities are considered attacks(false positives). If the threshold is set too high, then malicious activities are not identified (false negatives).
B.
If the threshold is set too low, non-intrusive activities are considered attacks (false negatives). If the threshold is set too high, then malicious activities are not identified (false positives).
C.
If the threshold is set too high, non-intrusive activities are considered attacks (false positives). If the threshold is set too low, then malicious activities are not identified (false negatives).
D.
If the threshold is set too high, non-intrusive activities are considered attacks (false positives). If the threshold is set too high, then malicious activities are not identified (false negatives).
Explanation:
Determining the proper thresholds for statistically significant deviations is really the key for the successful use of a behavior-based IDS. If thethreshold is set too low, non-intrusive activities are considered attacks (false positives). If the threshold is set too high, then malicious activities are not identified (false negatives).