Derive recall, precision, F1, specificity and balanced accuracy from a detection confusion matrix.
Recall and precision trade against each other: loosening a rule catches more real activity and more noise at the same time. The F-measure collapses that trade-off into one number, and balanced accuracy averages recall with specificity so the vast benign population cannot flatter the score. Plain accuracy is meaningless in security because the negative class dominates — a rule that alerts on nothing scores 99.9% accuracy and detects zero intrusions. Recall, precision and F-measure are what actually describe a detection.
True Positive Rate
Recall = TP ÷ (TP + FN). Precision = TP ÷ (TP + FP). Specificity = TN ÷ (TN + FP).
F-measure
Fβ = (1 + β²) × precision × recall ÷ (β² × precision + recall), so F1 is the harmonic mean and F2 weights recall four times as heavily.
Recall = TP ÷ (TP + FN). Precision = TP ÷ (TP + FP). Specificity = TN ÷ (TN + FP). Recall and precision trade against each other: loosening a rule catches more real activity and more noise at the same time. The F-measure collapses that trade-off into one number, and balanced accuracy averages recall with specificity so the vast benign population cannot flatter the score.
Plain accuracy is meaningless in security because the negative class dominates — a rule that alerts on nothing scores 99.9% accuracy and detects zero intrusions. Recall, precision and F-measure are what actually describe a detection.
This calculator takes 5 inputs: True positives, False negatives (missed detections), False positives, True negatives, F-measure weighting. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Recall first for anything on the critical path of a serious intrusion — ransomware staging, domain-admin abuse, exfiltration — and precision for high-volume commodity detections. F2 and F0.5 exist precisely so you can state which regime a rule is in.
Retrospectively: incidents found by a third party, by an audit, by threat hunting, or by red-team exercises that your rules never flagged. It is always an under-count, so treat measured recall as an optimistic upper bound.