What does this equation mean?

A simple way to see why the base rate of genuine misuse matters as much as the detector’s accuracy is the standard result relating a detector’s precision to how rare the thing it is looking for actually is. If a detection system has a true-positive rate $\text{TPR}$ and false-positive rate $\text{FPR}$ , and the true prevalence of the underlying misuse event in the traffic it sees is p , the fraction of flagged events that are genuinely misuse — the precision an analyst actually experiences — is $\text{Precision} = \frac{\text{TPR} \cdot p}{\text{TPR} \cdot p + \text{FPR} \cdot (1-p)}$. When p is small, which it almost always is for genuine, successful misuse against a well-defended system, precision collapses toward zero even for a detector with a very low false-positive rate, simply because the pool of benign traffic the false-positive rate applies to is so much larger than the pool of real events. Why this is worth stating formally rather than just asserting “false positives are a problem” : it shows that a headline detection accuracy figure (say, 99% true-positive rate) is close to meaningless on its own without the base rate and the false-positive rate reported alongside it, and it is exactly the kind of quantity a vendor claim can omit while still being technically accurate.