Ravi Sir's Cyber Security Cards › Comparison Cards
Signature vs Anomaly IDS – False Positives and False Negatives
Signature vs Anomaly IDS – False Positives and False Negatives An IDS watches network traffic for attacks. Signature-based : it matches known attack patterns , like a list of known thieves’ faces. Anomaly-based : it learns what is normal and alerts on anything unusual. Signature: fast and clear, but
Read card text
What this card says
What each one is
An IDS watches network traffic for attacks.
Signature-based: it matches known attack patterns, like a list of known thieves’ faces.
Anomaly-based: it learns what is normal and alerts on anything unusual.
Strengths and weaknesses
Signature: fast and clear, but misses brand-new attacks.
Anomaly: can catch new attacks, but also flags harmless new jobs.
Example
Signature: “This looks like a known Nmap scan” → alert.
Anomaly: “This server never touched 4,000 ports at 2 a.m.” → alert. It may be a new backup job.
Key terms
False positive: an alert, but no real attack.
False negative: a real attack, but no alert.
Tune noisy rules with a record. Do not just switch alerts off.
| Red team (attacker) does | Blue team (defender)… |
|---|---|
| Slightly changes a known payload so old signature misses… | Protocol parsers + content-normalise; update rules; anomaly… |
| Floods junk alerts so real C2 hides (FP noise) | Thresholds, suppress with evidence, don't "sid: disable all" |
| Lives in allowed HTTPS to a CDN-like host | TLS/SNI/JA3-class telemetry, DNS logs, egress allow-list |
Learn more in the lesson: 42.2 Signature vs Anomaly IDS – False Positives and False Negatives