Proper Use of ROC Curves in Intrusion/Anomaly Detection
Roy A. Maxion, R. R. Roberts · 2004
ROC curves (receiver operating characteristic curves) are commonly used to portray the performance of detectors in signal-detection tasks, such as intrusion detection. This report introduces the origins of signal-detection-theory, and the underpinnings of ROC curves. It provides examples of how to construct these curves, as well as how to measure, interpret and compare them. Information about accommodating cost of error is included. Materials are suggested for further reading.