Suppose that every packet observed by a network-based intrusion detection system (NIDS) belongs to one of the following mutually exclusive categories: legitimate (85% of all traffic), known worm (5%), distributed denial of service (5%) or port scan (5%).
The NIDS correctly classifies all known-worm packets. A legitimate packet is classified as legitimate with probability 90%, and misclassified as belonging to any of the three attack categories with equal probability. A DDoS packet is classified as DDoS with probability 50%, as a known worm with probability 40%, and as a legitimate packet with probability 10%. A port-scan packet is classified correctly with probability 90%, and misclassified as a legitimate packet with probability 10%.
If the NIDS announces that a particular packet belongs to a known worm