The Base-Rate Fallacy and its Implications for the Difficulty of Intrusion Detection

Published: Feb 21, 2000
Updated: Feb 21, 2000
Section: Network Security Library :: Intrusion Detection
Author:
Printable Version
Adjust font size:
Rating: 3/5 - 3 Votes

Many different demands can be made of intrusion detection systems. An important requirement is that it be effective. i.e. that it should detect a substantial percentage of intrusions into the supervised system, while still keeping the false alarm rate at an acceptable level.

This paper aims to demonstrate that, for a reasonable set of assumptions, the false alarm rate is the limiting factor for the performance of an intrusion detection system. This is due to the base-rate fallacy phenomenon, that in order to achieve substantial values of the Bayesian detection rate, P(Intrusion/Alarm), we have to achieve - a perhaps unattainably low - false alarm rate.

Click Here to download this article