All DDoS Definitions
DDoS Testing Definition

False-Negative Rate

False-negative rate is usually read off a mitigation dashboard as whatever the control did not block. That works only if the control could see the traffic it missed, which by definition it could not, and a DDoS test exists because the number has to be counted somewhere else. Properly defined, it is the share of attack traffic a control fails to recognise and lets through to the origin: missed attack traffic divided by all attack traffic. It is the mirror of the false-positive rate, and every threshold trades one against the other.

False-negative rate: the attack traffic that slips past the filter Attack traffic known flood flood in Mitigation filter thresholds tuned most dropped blocked discarded leaked past filter = false negatives Origin still saturated Mirror of the false-positive rate: false negatives admit attack packets, false positives reject real users. A test drives a known attack volume and counts how much reaches the origin, quantifying the leak so thresholds can be tightened. BlackNeuron™
Diagram of false-negative rate: a mitigation filter dropping most of a known flood while a fraction leaks past to the origin, the false negatives that quantify a control's coverage gap

Why the control cannot report it

A mitigation counts what it matches. Its block counter, its drop graphs and its "attack mitigated" banner all describe the traffic it recognised. The traffic it did not recognise looks, to the control, exactly like legitimate traffic, and is logged as such or not at all.

So a control that misses half a flood can still report a clean, successful mitigation.

The origin does see the misses, but mixed in with real users and without labels. All it can say is that load went up. That is why this is the one accuracy figure production almost never has.

Where misses come from

The percentage hides the size. A control that stops 98 percent of a 500 Gbps flood passes 10 Gbps, which on its own fills a 10 Gbps origin uplink. The unit that matters is the absolute leaked rate set against the headroom behind the control, not the ratio.

Misses also cluster rather than spreading evenly. The usual sources:

  • The detection window. Everything that arrives before mitigation engages is a miss, and a minute at full rate can be the whole outage.
  • A change of vector. Rules and signatures built for the first vector do not match the second, so the rate jumps after every pivot and falls only when a new match is pushed.
  • Traffic built to look normal. Valid requests from real browsers on residential proxies, each under the per-source threshold, are the class a rate or reputation control is least able to name.
  • Overload. An inline device that runs out of capacity and fails open passes everything. For as long as that lasts, its false-negative rate is 100 percent.
  • Sampling. Detection fed by flow records sampled at 1 in 1,000 or sparser can miss a small, expensive vector outright, because too few of its packets survive sampling to cross a threshold.

False-negative rate: the gap that opens each time the attack changes shape known vector, matched attack stopped before origin time into the attack rule matches the flood vector pivots, misses reach origin new match pushed catch rate back up The rate is not one number: it peaks in the window after every change the rules were not built for BlackNeuron™
Animated false-negative rate: the share of attack traffic stopped before the origin holds high while the rule matches the flood, drops when the vector pivots and misses reach the origin, then climbs back once a new match is pushed

What a DDoS test measures

A test has ground truth on the attack side. It knows exactly what it sent, so it can count what arrives at the origin, by vector, in packets and in requests. Sent minus absorbed is the rate, measured instead of inferred.

The useful report splits it by phase as well as by vector: the miss rate during onset, at steady state, and in the window after each pivot, with the leaked rate in absolute terms beside the origin's measured capacity. A control with a 1 percent steady-state miss rate and a 100 percent miss rate for the first ninety seconds is not a 1 percent control.

At layer 7 the leak also needs weighting. A thousand cached page hits and a thousand uncached search queries are the same count and very different loads on the origin, so a test records which endpoints the misses reached, not just how many there were.

Leakage is one of several places where a control's own report and its effect at the origin diverge, and How to Test DDoS Protection sets out the rest.