2000/08/01 by Stefan Axelsson · 1 citation
Computer Science · Engineering · #Network Security and Intrusion Detection #Anomaly Detection Techniques and Applications #Advanced Malware Detection Techniques #Intrusion detection system #Computer science #False alarm #Constant false alarm rate #ALARM #Fallacy #False positive rate #Set (abstract data type) #Intrusion #Data mining #Computer security #Artificial intelligence #Engineering
paper · pdf · doi:10.1145/357830.357849
openalex publication_date 2000/08/01 · openalex created_date 2025/10/10 · openalex updated_date 2026/08/04
Many different demands can be made of intrusion detection systems. An important requirement is that an intrusion detection system be effective ; that is, it should detect a substantial percentage of intrusions into the supervised system, while still keeping the false alarm rate at an acceptable level. This article demonstrates that, for a reasonable set of assumptions, the false alarm rate is the limiting factor for the performance of an intrusion detection system. This is due to the base-rate fallacy phenomenon, that in order to achieve substantial values of the Bayesian detection rate P(Intrusion***Alarm) , we have to achieve a (perhaps in some cases unattainably) low false alarm rate. A selection of reports of intrusion detection performance are reviewed, and the conclusion is reached that there are indications that at least some types of intrusion detection have far to go before they can attain such low false alarm rates.