Detecting Network Attacks
Firewalls and segmentation keep attackers out. Detective controls assume some will get in — and catch them by reading the millions of log entries a network produces every day.
A busy network logs millions of events a day — far more than any human team can read. So organizations run automated detection tools: an IDS that alerts, an IPS that alerts and acts, and a SIEM that pulls everything together. Increasingly, AI scores each event for how likely it is to be malicious.
But detection is a balancing act. Tune it too tight and real attacks slip through as false negatives; too loose and analysts drown in false positives until alert fatigue sets in. This topic is about reading the evidence and choosing the right detection method.
Collect & Detect
IDS, IPS, and SIEM analyze log data from across the network to flag malicious activity.
3.5.A · ToolsDecide with AI
AI scores each event's likelihood of being malicious; a tuned threshold decides what becomes an alert.
3.5.B · AIInvestigate & Respond
Analysts triage each alert against standard procedures: resolve, dismiss, or escalate.
3.5.D/E · TriageYou're staffing the security operations center (SOC). Logs stream in from firewalls, switches, servers, and IDS/IPS sensors. Your job: pick detection methods that fit the network, let AI prioritize the flood of events, and triage the alerts that reach your screen — telling real attacks from noise.
AP Learning Objectives
- 3.5.AIdentify types of automated security tools used to detect network attacks.
- 3.5.BExplain how organizations leverage AI to enhance threat detection and response.
- 3.5.CDetermine a network detection method.
- 3.5.DEvaluate the impact of a network detection method.
- 3.5.EApply detection techniques to identify indicators of network attacks by analyzing log files.
Detection is never perfect — it's a trade-off. Every choice of method and threshold balances catching real attacks against drowning in false alarms. The skill is reading the evidence and tuning that balance for the network you're protecting.
What you'll be able to do: match detection tools to their roles, classify detection outcomes, tune an AI alert threshold, analyze logs for indicators of compromise, evaluate detection methods, and triage SOC alerts.
From Logs to Alerts
Three tools turn raw log data into actionable alerts — and AI helps decide which ones deserve attention.
Everything starts with log data collected from switches, routers, servers, firewalls, and user computers. Automated tools read it. A network intrusion detection system (NIDS) analyzes the data and raises an alert when it spots malicious activity. A network intrusion prevention system (NIPS) does the same but can also act — closing ports, blocking an IP or MAC, or rejecting a protocol to halt the attack. A SIEM aggregates data from all of these sources, correlates it to find attack patterns, and hands analysts a single stream of alerts to investigate.
Because a network logs millions of events daily, organizations use AI to classify patterns as malicious or normal. These models are probabilistic — each event gets a likelihood percentage — and the organization sets a threshold for when that percentage becomes an alert.
Diagram · Network detection pipeline
IDS / IPS / SIEM Tool Matcher
Lab · 6 casesRead each capability and name the tool that provides it.
Concept Check
30 secAn IPS detects an attack in progress. What can it do that an IDS cannot?
Methods & Outcomes
The detection methods you choose from, and the four outcomes every detector produces.
| Method | How it works & trade-offs |
|---|---|
| Signature-based | Compares data to a database of known indicators (signatures). Fast, efficient for high traffic, almost no false positives — but can't catch new attacks and is easier to bypass. |
| Anomaly-based | Compares data to a baseline of normal activity (recorded on clean systems). Catches novel attacks, best on consistent-pattern networks — but slower, costlier hardware, more false positives. |
| Hybrid | Combines signature + anomaly. Best for sensitive/critical networks — but the most expensive and generates the most alerts. |
| Term | Meaning |
|---|---|
| True positive | An alert fires and the activity really was malicious. |
| False positive | An alert fires but the activity was benign — wastes analyst time. |
| True negative | No alert, and the activity really was benign. |
| False negative | No alert, but the activity was malicious — the adversary bypassed detection. |
| Alert fatigue | When too many false positives lead responders to take alerts less seriously. |
| Indicator of compromise (IoC) | Evidence in logs/traffic suggesting an attack — malicious IPs, scans, traffic spikes, mismatched port/application. |
False Positive / False Negative Classifier
Lab · ClassifySelect each detection outcome, then drop it into the right quadrant of the confusion matrix.
True positive
Alert · was malicious
False positive
Alert · was benign
True negative
No alert · was benign
False negative
No alert · was malicious
What the Exam Rewards
This topic is Detect Attacks — skills 3.C (evaluate detection-method impact) and 3.D (detect & classify attacks from evidence, with and without AI).
The threshold trade-off. Set it too high and real attacks slip through (false negatives). Set it too low and analysts are buried in false positives. The exam tests both directions.
Method ≠ one-size-fits-all. Match the method to the network: signature for high volume and speed, anomaly for novel attacks, hybrid for critical systems with budget.
Diagram · AI-assisted detection loop
Common MCQ traps
"Signature-based detection catches new attacks."
It can't — it only matches known signatures. Anomaly-based detection is needed for novel attacks.
"More alerts means more security."
Too many false positives cause alert fatigue — real threats get ignored.
"AI gives a yes/no malicious verdict."
AI models are probabilistic — they output a likelihood percentage, and a threshold turns it into an alert.
Analyst note — SOC: the AI scores a login burst at 92% malicious and a nightly backup at 40%. With the alert threshold at 75%, only the login burst pages an analyst. Lower the threshold and the backup starts paging too — a false positive that erodes trust in the system.
AI-Assisted Detection Prioritizer
Lab · TuneThe AI has scored tonight's events. Drag the alert threshold and watch how many real attacks you miss (false negatives) versus how many false alarms you raise (false positives).
Read the Logs, Name the Attack
The core skill: analyze log evidence and identify the indicator of compromise it reveals.
Network Log IoC Analyzer
Lab · Analyze (3.D)Each entry comes off the SOC console. Read the evidence and identify which attack — or normal traffic — it indicates.
Misconceptions That Cost Points
Each is a planted wrong answer. Learn to see the trap.
"An IDS stops attacks."
An IDS only detects and alerts. An IPS is what can actively block or halt the attack.
"A false negative is a harmless mistake."
A false negative means an attack went undetected — the adversary may cause real loss or damage.
"Anomaly detection works on any network."
It's most effective on networks with consistent traffic patterns, and needs a clean baseline.
"Hybrid detection is always the right choice."
It's the most expensive and noisiest. Reserve it for sensitive or critical networks with the budget.
"Signature databases never need updating."
They must be updated with indicators for the latest attacks, or new threats sail past.
"A SIEM replaces human analysts."
A SIEM raises alerts; analysts still investigate them and follow procedures to resolve or escalate.
Detection Signatures & Triage
How specific attacks show up in logs, plus two labs: triage live alerts, then choose the right detection method.
| Attack | Indicator to look for |
|---|---|
| Evil-twin | SSIDs suspiciously similar to a legitimate one; use signal triangulation to locate the AP. |
| Jamming | No devices in an area can connect; EM noise in the wireless range. |
| ARP poisoning | Unusual ARP messages — especially duplicate-MAC ARP packets; check the gateway's ARP table. |
| MAC flooding | Surge of Ethernet frames with many different MACs; check the switch's MAC table. |
| DNS poisoning | Hard to detect; an abrupt, unexplained drop in website traffic warrants checking DNS records. |
| Smurf (DoS) | Sudden spike of ICMP requests aimed at the network's broadcast address. |
Diagram · Alert triage flow
Network Alert Triage Board
Lab · 5 alertsEach alert lands on your queue. Decide how to handle it following standard procedure.
Detection Method Impact Evaluator
Lab · 5 networksFor each network's priorities, choose the detection method whose impact fits best.
Prove the Detection Plan
Five AP-style questions with instant feedback, then a snapshot to lock it in.
Mini AP-Style Quiz
Lab · 5 questionsChoose one answer per question, then submit for scored feedback with explanations.
Five Takeaways
Tools, three roles. IDS detects & alerts; IPS also acts; SIEM correlates many sources for analysts.
AI scores, humans decide. Models output a likelihood %; a tuned threshold turns it into an alert.
Method fits the network. Signature = fast/known; anomaly = novel attacks; hybrid = critical (costliest).
Mind the errors. False positives cause alert fatigue; false negatives let attacks through.
Logs hold the evidence. Duplicate-MAC ARP, MAC surges, ICMP-to-broadcast, rogue SSIDs, malicious-IP connections.
Final AP exam tip: for "which detection method" questions, anchor on the criterion — traffic volume, pattern consistency, criticality, or likelihood of novel attacks — then justify with the impact (speed, cost, false-positive/negative rate). For log questions, name the specific indicator that gives the attack away.
One mistake to avoid: don't conflate detection with prevention. Detecting an attack raises an alert; only an IPS (or a human following it up) actually stops it.
Practice — attempt these now.
AP-style assessments aligned to this lesson. Time them.