In IDS terms, what describes the situation where the IDS discards packets that the host would normally accept?

In IDS terms, what describes the situation where the IDS discards packets that the host would normally accept?

• A. Insertion Attack
• B. Evasion
• C. Mirai Botnet Attack
• D. False Positive Generation

Answer: (B)

Evasion happens when traffic is crafted or handled in a way that bypasses the IDS’s ability to detect or allow it, allowing the target to receive what it would normally accept while the IDS acts as if nothing is malicious. If the IDS ends up dropping packets that the host would normally accept, it demonstrates the IDS failing to deliver legitimate traffic or misclassifying it in a way that prevents it from reaching the host, which is a form of evasion because the detection system is not properly allowing normal flow. Insertion attacks would involve adding extra packets to confuse the IDS, false positives would mean the IDS flags legitimate traffic as malicious, and Mirai Botnet Attack refers to a specific botnet incident rather than a general detection bypass technique.

Evasion happens when traffic is crafted or handled in a way that bypasses the IDS’s ability to detect or allow it, allowing the target to receive what it would normally accept while the IDS acts as if nothing is malicious. If the IDS ends up dropping packets that the host would normally accept, it demonstrates the IDS failing to deliver legitimate traffic or misclassifying it in a way that prevents it from reaching the host, which is a form of evasion because the detection system is not properly allowing normal flow. Insertion attacks would involve adding extra packets to confuse the IDS, false positives would mean the IDS flags legitimate traffic as malicious, and Mirai Botnet Attack refers to a specific botnet incident rather than a general detection bypass technique.