Symbol pi

The passage around this formula

When $\pi$ is very small, as it genuinely is in most enterprise traffic, even a detector with a low false-positive rate in isolation produces an alert stream that is mostly false alarms, because the enormous volume of benign events supplies far more raw false positives than the rare true attacks supply true ones. This is a property of the base rate, not of whether the detector is a hand-written rule or a trained model — but it explains why a rule-based system’s chief advantage has historically been precision on known, narrowly specified patterns, and why an AI-driven system’s chief promise is catching what no rule was written for, at the cost of a less predictable false-positive profile.

Read this part in the article →