Numerator: pi × TPR

The passage around this formula

The arithmetic behind that claim generalizes directly to any detector, rule-based or AI-driven, and it is worth stating because it is the crux of why the two kinds of tooling are hard to compare on accuracy alone. If the base rate of genuine attacks among all monitored events is $\pi$ , and a detector has true-positive rate $\mathrm{TPR}$ and false-positive rate $\mathrm{FPR}$ , Bayes’ rule gives the probability that a flagged event is a real attack as $P(\text{attack} \mid \text{flagged}) = \frac{\pi \cdot \mathrm{TPR}}{\pi \cdot \mathrm{TPR} + (1-\pi)\cdot \mathrm{FPR}}$. When $\pi$ is very small, as it genuinely is in most enterprise traffic, even a detector with a low false-positive rate in isolation produces an alert stream that is mostly false alarms, because the enormous volume of benign…

Read this part in the article →