addition

The passage around this formula

A simple way to see why the base rate of genuine misuse matters as much as the detector’s accuracy is the standard result relating a detector’s precision to how rare the thing it is looking for actually is. If a detection system has a true-positive rate $\text{TPR}$ and false-positive rate $\text{FPR}$ , and the true prevalence of the underlying misuse event in the traffic it sees is p , the fraction of flagged events that are genuinely misuse — the precision an analyst actually experiences — is $\text{Precision} = \frac{\text{TPR} \cdot p}{\text{TPR} \cdot p + \text{FPR} \cdot (1-p)}$. When p is small, which it almost always is for genuine, successful misuse against a well-defended system, precision collapses toward zero even for a detector with a very low…

Read this part in the article →