Network › Module 2 › Lesson 3
False Positives You Must Expect
Every detector cries wolf — then classify YOUR hits as useful vs noise.
Visual · ids_false_positives
False positives are part of detection. Count and label YOUR loopback alerts on
Opening
If every curl is an incident, you do not have detection. You have an alarm clock taped to a siren.
Lessons 1–2 gave you a verb and a pattern. This lesson is the tax: false positives (the detector yelled, the world was fine) and false negatives (the world was not fine, the detector napped). Beginners treat a red badge as guilt. Operators treat a red badge as a ticket that needs ranking. Your loopback toy will generate both “I meant to hit /hit” and “this path looks like a scanner even though it was you.” Original Cyberlium. GATE on http://192.168.0.1/: TP-Link/Netgear/Huawei stay on You will label YOUR own requests as expected vs surprising. You will not hping3 a neighbor to “see IPS false positives,” not ettercap to manufacture weird frames, and not disable a campus IDS because it annoyed you. Next: Lab — Local Alert from Your Loopback App.
1. Name the four boxes before you tune anything
True positive: you sent a path you consider interesting and the log agrees. True negative: boring request, silence. False positive: boring request, noise. False negative: interesting request, silence. Until those four words are in YOUR note file, “tuning” is just deleting lines that embarrassed you.
On you can manufacture the matrix ethically: curl / and call it expected; curl /hit and call it a detect-worthy teaching path; curl /favicon.ico if it 404s and decide whether a 404 is an “attack.” first. — you do not tune a home gateway’s supposed IPS in this course.
2. Expected hits are not incidents just because a pattern matched
If your signature is /hit and you curl /hit for class, the alert is a true positive for the pattern and a false emergency for the human. That split is the whole job. SOC burnout is often unsigned expected traffic. Write expected_paths.txt for YOUR toy and compare.
Do not “reduce false positives” by pointing the detector at a bigger network. More strangers means more unexplained curls — not wisdom. Stay on loopback. Count, then label.
Command guide
Expected hits are not incidents just because a pattern matched
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ COMMANDS ═══
Command — copy this
printf '%s
' '/' '/hit' '/lab' > "$HOME/cyberlium-lab/t11-m02-expected-paths.txt"
for p in / /hit /this-is-not-expected; do
code=$(curl -sS -m 2 -o /dev/null -w "%{http_code}" "$SAFE$p" || echo "000")
done
grep -c "path=/this-is-not-expected" "$HOME/cyberlium-lab/t11-m02-fp-sample.log"
grep -c "path=/" "$HOME/cyberlium-lab/t11-m02-fp-sample.log"3. Tuning is raising cost for noise, not going mute
A mute button is not tuning. Tuning is: this path is expected from this source (you, loopback), so page it lower; this path is still worth a line. False negatives hide in mute culture — the next real surprise looks like the noise you ignored.
You will append a label column: expected_true_positive_pattern vs surprise_needs_human vs ignore_404_for_now. You will not hping3 to stress a preventer, and you will not ask a friend to arpspoof you “to generate IPS events.”
Command guide
Tuning is raising cost for noise, not going mute
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3 sudo apt install dnsutils
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/ Use nslookup (built-in)
═══ COMMANDS ═══
Command — copy this
python3 - << 'PY'
from pathlib import Path
home = Path.home() / "cyberlium-lab"
exp = set()
ep = home / "t11-m02-expected-paths.txt"
if ep.exists():
exp = {ln.strip() for ln in ep.read_text(encoding="utf-8").splitlines() if ln.strip()}
out = home / "t11-m02-fp-labeled.txt"
lines = (home / "t11-m02-fp-sample.log").read_text(encoding="utf-8", errors="replace").splitlines() if (home / "t11-m02-fp-sample.log").exists() else []
labels = []
for ln in lines:
path = ""
for part in ln.split():
if part.startswith("path="):
path = part.split("=", 1)[1]
lab = "expected" if path in exp else "surprise"
labels.append(f"{ln} label={lab}")
out.write_text("
".join(labels) + ("
" if labels else ""), encoding="utf-8")
print("labeled", len(labels), "surprise", sum(1 for x in labels if "label=surprise" in x))
PYCommand — copy this
grep -c "label=surprise" "$HOME/cyberlium-lab/t11-m02-fp-labeled.txt"
4. What you ship: a four-box vocabulary and labeled rows from YOUR curls
Matrix file exists. expected_paths.txt exists. Sample log from is labeled expected vs surprise. Mute is not a strategy. No LAN traffic to “create” false positives.
5. What you record before the next lesson
Date. TP/TN/FP/FN one line each. DEMO GATE. SAFE Surprise count from t11-m02-fp-labeled.txt. chmod 600. NEVER hping3/ettercap/nmap.
6. Wrong vs right: stranger networks vs literacy on systems you own
Worked failure — same network word, opposite target. Right never needs a café or campus LAN.
Wrong
Turn off the campus IDS because of noise. hping3 the gateway to see what false positives look like. Treat every /hit teaching curl as a fire.
Right
Label YOUR loopback rows. Keep expected paths written. Next: Lab — Local Alert from Your Loopback App.
Mission: label YOUR alerts instead of believing the siren
1) / STOP if router. 2) Curl at least two paths on 3) Label each row expected vs surprise in cyberlium-lab. Do not flood anyone. Do not mute a network you do not run.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor how to write expected_paths.txt for a toy you own — not how to suppress a university SOC.
Knowledge Check
APPLY: You curl /hit on YOUR toy because the lesson said to, and a signature on /hit fires. Best label?
Multiple choice
Knowledge Check
APPLY: True or False: Muting all alerts is a valid way to “tune false positives.”
True or False
Knowledge Check
APPLY: A blog says generate IPS false positives with hping3 against 192.168.0.1. Cyberlium says:
Multiple choice