There can be misuse at the Internet and transport layer protocols. The SYN flood denial of service attack, for example, involves sending many packets which appear to initiate new connections from a server, but in reality have spoofed source addresses. These connections can never be completed, but will block legitimate requests from succeeding. This is an attack often aimed at Web servers. A network can be probed for TCP servers by attempting to open connections at a range of ports on one or more systems.
Misuse can certainly appear at the application protocol level.
False Alarm Intrusion detection systems must use an exhaustive set of attack signatures, so as to not miss any abusive activities. The earliest systems simply used misuse detection and thresholds. A failed login attempt would have to be repeated several times before an alarm would be raised. Setting the threshold too low meant too many false alarms. Too high a threshold may mean that attacks are missed.