The Base-Rate Fallacy and the Difficulty of Intrusion Detection¶
Axelsson, S. (2000). The Base-Rate Fallacy and the Difficulty of Intrusion Detection. ACM, 3(3), 186-205.
Cited by¶
3 citations across 3 artifacts.
Each citation links to the sentence it supports in the citing article.
Mechanisms¶
- Anomaly Detection
- When true anomalies are genuinely rare, even an accurate detector produces mostly false alarms, because the flood of ordinary variation dwarfs the handful of real events.
This sourceShows why rare true events can leave even accurate detectors with alarms dominated by false positives.
- When true anomalies are genuinely rare, even an accurate detector produces mostly false alarms, because the flood of ordinary variation dwarfs the handful of real events.
- Pre-Decision Conflict Screen
- Its central failure mode is the false-positive flood: an over-sensitive matcher that flags every shared conference or common surname, so reviewers learn to rubber-stamp releases and stop reading the flags — the base-rate problem that afflicts any high-volume screen.
This sourceShows that the base-rate problem can create a false-positive flood in high-volume screening.
- Its central failure mode is the false-positive flood: an over-sensitive matcher that flags every shared conference or common surname, so reviewers learn to rubber-stamp releases and stop reading the flags — the base-rate problem that afflicts any high-volume screen.
- Rare Event Monitor
- Its named hazard is the base rate fallacy
This sourceDerives how low event prevalence can make alarms predominantly false positives even for apparently strong detectors, so an alarm requires investigation.
- Its named hazard is the base rate fallacy
Verification¶
Does it exist? Confirmed. This work's DOI resolves to a registered record, which fixes its identity. That is all it fixes.
Does it back the claim? Not recorded. Neither this nor any other of the 3 citations of this work carries a recorded support check.
Support is checked per citation rather than per work — the same source can be cited soundly in one article and wrongly in another. Per-citation recording began recently, so a citation with no recorded check is a gap in the record rather than evidence it went unchecked.
See how references were verified.
Registry ID ref:90c2c5d42c3f · see in the full table