QuestionQ44Verified/Risk Identification, Monitoring and AnalysisCopy linkReport a problemAsk AstroTutorSave questionWhy do anomaly-detection IDSs frequently produce a high number of false positives?ABecause they can only identify correctly attacks they already know about.BBecause they are application-based are more subject to attacks.CBecause they can't identify abnormal behavior.DBecause normal patterns of user and system behavior can vary wildly.Show AnswerAnswerExplanationAnomaly-detection IDSs flag activity that deviates from an expected baseline. Since legitimate user and system behavior can vary widely, normal but unusual activity may be treated as suspicious and generate false positives.Show comments0Show commentsCommunity DiscussionNo comments yet. Be the first to start the discussion!
Community Discussion