Hands-On Artificial Intelligence for Cybersecurity

Receiver operating characteristic analysis

Often, between false positives and false negatives, there is a trade-off. Reducing the number of false negatives or the number of attacks not detected leads to an increase in false positive attacks being detected. To show the existence of this trade-off, a particular curve, known as the receiver operating characteristic (ROC) curve, is used. In our example, the ROC curve is calculated by using roc_curve() of scikit-learn, to which the target values and the corresponding probabilities are passed as parameters:

from sklearn.metrics import roc_curveFPR, TPR, OPC = roc_curve(targets, probs)

It is possible to note the link between True Positive Rate (TPR or sensitivity), False Positive Rate (FPR), and ...