{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/false-positive","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/false-positive/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/false-positive/"},"term":{"en":"False positive","da":"Falsk positiv"},"aka":{"en":["false alarm"],"da":["falsk alarm"]},"domain":["security"],"cluster":"security-operations","status":"current","summary":{"en":"An alarm about an attack or problem that turns out not to exist, because harmless activity was taken for harmful.","da":"En alarm om et angreb eller et problem, der viser sig ikke at findes, fordi harmløs aktivitet blev taget for skadelig."},"body":{"formal":{"en":"The result when a monitoring tool, rule or model marks harmless activity as harmful; its opposite, a false negative, is a real attack that raises no alarm at all.","da":"Resultatet, når et overvågningsværktøj, en regel eller en model markerer harmløs aktivitet som skadelig; det modsatte, en falsk negativ, er et reelt angreb, der slet ikke udløser nogen alarm."},"plain":{"en":"Like a car alarm that goes off every time a lorry drives past; after a week, nobody on the street even looks up.","da":"Som en billarm, der går i gang, hver gang en lastbil kører forbi; efter en uge er der ingen på gaden, der så meget som kigger op."},"inPractice":{"en":"At a pension fund, an alarm reports “possible data theft” from the finance drive; the analyst sees it is the report job that runs on the last day of every month, and closes it.","da":"I en pensionskasse melder en alarm “muligt datatyveri” fra økonomiafdelingens drev; analytikeren ser, at det er rapportkørslen, der kører den sidste dag i hver måned, og lukker den."},"whyItMatters":{"en":"Each one wastes a little time, but many of them teach staff to ignore alarms - and then the one real attack is waved through with the rest.","da":"Hver enkelt spilder lidt tid, men mange af dem lærer medarbejderne at ignorere alarmer - og så bliver det ene reelle angreb vinket igennem sammen med resten."}},"deepDive":{"en":"Formally, a false positive is the FP cell of the confusion matrix: a detector predicts the positive class (malicious, vulnerable, spam) for an instance that is actually negative. Three derived rates are routinely confused. The false-positive rate, FP / (FP + TN), is the share of benign events that trigger an alert. Precision, TP / (TP + FP), is the share of alerts that are real. The false discovery rate, 1 − precision, is what analysts actually experience as noise. A detector can have an excellent false-positive rate and still terrible precision, and in statistics a false positive corresponds to a Type I error.\n\nThe reason is the base rate. Suppose one event in 100,000 is malicious and a detector catches 99% of malicious events while wrongly flagging only 1% of benign ones. Out of a million events, about 10 are malicious and roughly 10 of those alerts are true, but about 10,000 benign events are flagged, so fewer than one alert in a thousand is real. Axelsson's 2000 paper on the base-rate fallacy in intrusion detection made this argument formally, and it explains why security teams judge detections by precision and alert volume per day, not by accuracy.\n\nIn SOC practice it is useful to separate a false positive (the rule matched something it was not meant to match, a logic or data error) from a benign true positive (the rule matched exactly the intended behaviour, but in this case it was authorised, such as an administrator using PsExec or a scheduled vulnerability scan). The remedies differ: the first calls for fixing the rule or its parsing, the second for narrowly scoped exceptions or context enrichment. Tuning always trades against false negatives, the missed attacks, and broad exclusions (a whole directory, a signed binary, a service account) create blind spots attackers can use, particularly with living-off-the-land techniques that deliberately look like administration.\n\nFalse positives are not just an efficiency problem. Chronic noise produces alert fatigue and normalisation of deviance; post-incident analyses of the 2013 Target breach reported that malware alerts had been raised but not acted on. In prevention controls, a false positive causes direct harm: in April 2010 a McAfee antivirus definition update (DAT 5958) misidentified the Windows file svchost.exe as malware on Windows XP SP3 machines, sending many into reboot loops. The same concept appears across security tooling: static analysis findings that are not exploitable, spam filters quarantining legitimate mail, and data loss prevention rules blocking normal business transfers. Measuring the false-positive share per rule over time is the basic input for detection engineering.","da":"Formelt er en falsk positiv FP-cellen i forvekslingsmatricen: en detektor forudsiger den positive klasse (ondsindet, sårbar, spam) for et tilfælde, der i virkeligheden er negativt. Tre afledte rater forveksles ofte. Falsk positiv-raten, FP / (FP + TN), er andelen af godartede hændelser, der udløser en alarm. Præcision, TP / (TP + FP), er andelen af alarmer, der er ægte. False discovery rate, 1 − præcision, er det, analytikerne faktisk oplever som støj. En detektor kan have en fremragende falsk positiv-rate og alligevel elendig præcision, og i statistik svarer en falsk positiv til en type I-fejl.\n\nÅrsagen er basisraten. Antag, at én hændelse ud af 100.000 er ondsindet, og at en detektor fanger 99 % af de ondsindede hændelser, mens den fejlagtigt markerer kun 1 % af de godartede. Ud af en million hændelser er omkring 10 ondsindede, og cirka 10 af alarmerne er ægte, men omkring 10.000 godartede hændelser markeres, så færre end én alarm ud af tusind er reel. Axelssons artikel fra 2000 om base rate-fejlslutningen i intrusion detection fremførte argumentet formelt, og det forklarer, hvorfor sikkerhedsteams vurderer detektioner på præcision og alarmmængde pr. dag, ikke på nøjagtighed.\n\nI SOC-praksis er det nyttigt at skelne mellem en falsk positiv (reglen ramte noget, den ikke skulle ramme, en fejl i logik eller data) og en godartet sand positiv (reglen ramte præcis den tilsigtede adfærd, men i dette tilfælde var den godkendt, fx en administrator, der bruger PsExec, eller en planlagt sårbarhedsscanning). Afhjælpningen er forskellig: den første kræver, at reglen eller dens parsing rettes, den anden snævert afgrænsede undtagelser eller berigelse med kontekst. Justering er altid en afvejning mod falske negativer, de oversete angreb, og brede undtagelser (en hel mappe, en signeret binærfil, en servicekonto) skaber blinde vinkler, som angribere kan udnytte, især med living off the land-teknikker, der bevidst ligner almindelig administration.\n\nFalske positiver er ikke kun et effektivitetsproblem. Vedvarende støj giver alarmtræthed og en normalisering af afvigelser; analyser af Target-bruddet i 2013 beskrev, at der var udløst malware-alarmer, som ikke blev fulgt op. I forebyggende kontroller gør en falsk positiv direkte skade: i april 2010 udpegede en McAfee-signaturopdatering (DAT 5958) Windows-filen svchost.exe som malware på maskiner med Windows XP SP3, så mange gik i genstartsløkker. Samme begreb findes i hele sikkerhedsværktøjskassen: fund fra statisk kodeanalyse, der ikke kan udnyttes, spamfiltre, der sætter legitim post i karantæne, og DLP-regler, der blokerer almindelige forretningsoverførsler. At måle andelen af falske positiver pr. regel over tid er det grundlæggende input til detection engineering."},"edges":[{"type":"requires","to":"platform/alerting","confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"security/security-incident","why":{"en":"A security incident is real harm or a real threat; a false positive only looked like one until someone checked.","da":"En sikkerhedshændelse er reel skade eller en reel trussel; en falsk positiv lignede kun en, indtil nogen tjekkede."},"confidence":"high","strength":"primary"},{"type":"used-with","to":"security/soc","confidence":"high","strength":"normal"}],"depth":2,"sources":[{"title":"NIST SP 800-94 - Guide to Intrusion Detection and Prevention Systems (IDPS)","url":"https://doi.org/10.6028/NIST.SP.800-94","tier":"standard","publisher":"NIST"},{"title":"Cyber Security Fast Track - SIEM module","tier":"course-material"}],"draft":true}