False alarms
False alarms are IPS events that you do not want occurring in your implementation. There are two types of these alarms: false positive and false negative. Both are undesirable.
False Positive : A false positive means that an alert has been triggered, but it was for traffic that does not constitute an actual attack. This type of traffic is often referred to as benign traffic.
False Negative : A false negative occurs when attack traffic does not trigger an alert on the IPS device. This is often viewed as the worst type of false alarm, for obvious reasons.
True alarms
There are two types of true alarms in IPS terminology. Both true positives and true negatives are desirable.
True positive : A true positive means that an attack was recognized and responded to by the IPS device.
True negative : This means that nonoffending or benign traffic did not trigger an alarm.
