📊 10-07: Evaluating Detection Models¶
📌 Why Accuracy Alone Isn't Enough¶
Once a model produces predictions (y_pred) against the true test labels (y_test, from 10-06: Building & Training the IDS Model), we need a rigorous way to measure how good those predictions actually are — not just a gut feeling.
💡 It's tempting to just ask "what percentage did it get right?" (accuracy), but in security, not all mistakes are equal. A model that's 99% accurate could still be dangerously bad if the 1% it gets wrong is exactly the attacks that matter most. This is why intrusion detection evaluation always starts with the confusion matrix.
🧮 The Confusion Matrix¶
A confusion matrix breaks predictions down into four specific outcomes, comparing what the model predicted against what was actually true:
| Predicted: Normal | Predicted: Attack | |
|---|---|---|
| Actual: Normal | ✅ True Negative (TN) | ❌ False Positive (FP) |
| Actual: Attack | ❌ False Negative (FN) | ✅ True Positive (TP) |
What Each Cell Means Operationally in an IDS¶
| Outcome | What It Means | Real-World Impact |
|---|---|---|
| True Positive (TP) | Model correctly flags a real attack | The attack is caught — great outcome |
| True Negative (TN) | Model correctly identifies normal traffic as normal | Business as usual, no wasted effort |
| False Positive (FP) | Model flags normal traffic as an attack | A false alarm — analysts waste time investigating nothing; too many of these cause "alert fatigue," where real alerts start getting ignored |
| False Negative (FN) | Model misses a real attack, calls it normal | A missed attack — the most dangerous outcome; the intrusion goes completely undetected |
💡 The critical asymmetry: a false positive costs an analyst a few minutes of wasted investigation. A false negative can mean a full-blown breach goes unnoticed until real damage is done. This asymmetry drives the entire discussion below.
🔢 Worked Example¶
Suppose a trained IDS model is evaluated on a test set and produces this confusion matrix:
| Predicted: Normal | Predicted: Attack | |
|---|---|---|
| Actual: Normal | TN = 3456 | FP = 42 |
| Actual: Attack | FN = 43 | TP = 4017 |
This means: - 3,456 normal connections were correctly identified as normal - 4,017 real attacks were correctly caught - 42 normal connections were incorrectly flagged as attacks (false alarms) - 43 real attacks slipped through undetected (missed attacks)
From these four numbers, we can compute every standard evaluation metric.
📐 Accuracy¶
Accuracy = the fraction of all predictions that were correct.
💡 Limitation: accuracy treats FP and FN as equally bad, and it can look deceptively high on imbalanced datasets (e.g., if 95% of traffic is normal, a model that predicts "normal" for everything scores 95% accuracy while catching zero attacks).
🎯 Precision¶
Precision answers: "Of everything the model flagged as an attack, how many actually were attacks?" It measures how trustworthy a positive (attack) alert is.
Low precision means analysts are frequently chasing false alarms.
🔁 Recall (Sensitivity / True Positive Rate)¶
Recall answers: "Of all the attacks that actually happened, how many did the model catch?" It measures how thorough the detector is at finding real threats.
Low recall means the model is letting attacks slip through undetected — the scenario security teams fear most.
⚖️ F1-Score¶
The F1-score is the harmonic mean of precision and recall — a single number that balances both, useful when you want one metric that penalizes a model for being lopsided (e.g., very high precision but very low recall, or vice versa).
📋 Metric Summary Table¶
| Metric | Formula | Value (Worked Example) | Answers |
|---|---|---|---|
| Accuracy | (TP+TN)/(TP+TN+FP+FN) | 0.9888 | "How often is the model right overall?" |
| Precision | TP/(TP+FP) | 0.9897 | "When it says 'attack,' can I trust it?" |
| Recall | TP/(TP+FN) | 0.9894 | "Of all real attacks, how many did it catch?" |
| F1-Score | 2·(P·R)/(P+R) | 0.9895 | "A single balanced score of precision and recall" |
In scikit-learn, these are computed directly from the true and predicted labels:
from sklearn.metrics import confusion_matrix, classification_report, f1_score, accuracy_score
cm = confusion_matrix(y_test, y_pred)
print(cm)
print("F1 Score:", f1_score(y_test, y_pred))
print("Accuracy:", accuracy_score(y_test, y_pred))
print(classification_report(y_test, y_pred))
🚨 Why Recall Is Often Prioritized Over Precision in Security¶
In many other ML applications (like spam filtering), a false positive is mildly annoying — a real email lands in the spam folder. But in intrusion detection:
- A false negative (missed attack) can mean a breach, data theft, or ransomware deployment goes completely unnoticed until it's too late
- A false positive (false alarm) just costs an analyst a few minutes to investigate and dismiss
Because the cost of a false negative is so much higher than the cost of a false positive, security teams often deliberately tune their models to favor recall over precision — accepting more false alarms in exchange for catching more real attacks.
💡 This is also why security operations centers invest heavily in automated triage and alert prioritization tools — high-recall models naturally generate more false positives, and the organization needs a way to manage that noise without missing the real threats buried in it.
📌 Key Takeaways¶
- The confusion matrix breaks predictions into True Positive, True Negative, False Positive, and False Negative.
- In IDS terms: a false positive is a false alarm (wastes analyst time); a false negative is a missed attack (the dangerous outcome).
- Accuracy measures overall correctness but can be misleading on imbalanced datasets.
- Precision measures how trustworthy "attack" alerts are; recall measures how many real attacks are actually caught.
- F1-score balances precision and recall into a single number.
- Security-critical systems typically prioritize recall over precision, because missing an attack is far more costly than investigating a false alarm.
- These metrics should always be computed on the held-out test set (10-06: Building & Training the IDS Model), never on training data.