IDS Evasion - False Positive Generation

This mode does not attack the target; instead, it does something relatively ordinary.

• In this mode, the IDS generates an alarm when no condition is present to warrant one.
• Another attack similar to the DoS method is to create a significant amount of alert data that the IDS will log.
• Attackers construct malicious packets known to trigger alerts within the IDS, forcing it to generate a large number of false reports.
• Such an attack creates a large amount of log "noise" in an attempt to blend real attacks with fake ones.
• Attackers know all too well that when looking at log data, it can be challenging to differentiate between legitimate attacks and false positives.
• If attackers know the IDS, they can even generate false positives specific to that IDS.
• Attackers then use these false positive alerts to hide real attack traffic.
• Attackers can bypass IDS unnoticed, as it is difficult to differentiate the attack traffic from the large volume of false positives.