True Positive Rate Calculator
Derive recall, precision, F1, specificity and balanced accuracy from a detection confusion matrix.
Inputs
Detection engineering usually favours recall (F2); a noisy queue favours precision (F0.5).
True Positive Rate (Recall)
84.00%
Precision
16.67%
F-Measure
0.27810–1
Specificity (True Negative Rate)
99.8866%
Balanced Accuracy
91.94%
Miss Rate (False Negative Rate)
16.00%
Detection Quality Verdict
Adequate recall — the misses are where the risk sits
Step by step
Values used
True positives = 42 alerts; False negatives (missed detections) = 8 incidents; False positives = 210 alerts; True negatives = 185,000 events; F-measure weighting = F1 — precision and recall equally
True Positive Rate
Recall = TP ÷ (TP + FN). Precision = TP ÷ (TP + FP). Specificity = TN ÷ (TN + FP).
F-measure
Fβ = (1 + β²) × precision × recall ÷ (β² × precision + recall), so F1 is the harmonic mean and F2 weights recall four times as heavily.
True Positive Rate (Recall)
= 84.00
Precision
= 16.67
F-Measure
= 0.2781 0–1
Specificity (True Negative Rate)
= 99.8866
Balanced Accuracy
= 91.94
Miss Rate (False Negative Rate)
= 16.00
How it works
Recall and precision trade against each other: loosening a rule catches more real activity and more noise at the same time. The F-measure collapses that trade-off into one number, and balanced accuracy averages recall with specificity so the vast benign population cannot flatter the score. Plain accuracy is meaningless in security because the negative class dominates — a rule that alerts on nothing scores 99.9% accuracy and detects zero intrusions. Recall, precision and F-measure are what actually describe a detection.
Formulas
True Positive Rate
Recall = TP ÷ (TP + FN). Precision = TP ÷ (TP + FP). Specificity = TN ÷ (TN + FP).
- TP
- Correctly alerted malicious activity
- FN
- Malicious activity that produced no alert
- FP
- Benign activity that produced an alert
- TN
- Benign activity correctly ignored
F-measure
Fβ = (1 + β²) × precision × recall ÷ (β² × precision + recall), so F1 is the harmonic mean and F2 weights recall four times as heavily.
- β
- Weighting factor — 1 balanced, 2 recall-favouring, 0.5 precision-favouring
Frequently Asked Questions
How is True Positive Rate calculated?
Recall = TP ÷ (TP + FN). Precision = TP ÷ (TP + FP). Specificity = TN ÷ (TN + FP). Recall and precision trade against each other: loosening a rule catches more real activity and more noise at the same time. The F-measure collapses that trade-off into one number, and balanced accuracy averages recall with specificity so the vast benign population cannot flatter the score.
Why does True Positive Rate matter?
Plain accuracy is meaningless in security because the negative class dominates — a rule that alerts on nothing scores 99.9% accuracy and detects zero intrusions. Recall, precision and F-measure are what actually describe a detection.
What values do I need to enter?
This calculator takes 5 inputs: True positives, False negatives (missed detections), False positives, True negatives, F-measure weighting. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Should I optimise for recall or precision?
Recall first for anything on the critical path of a serious intrusion — ransomware staging, domain-admin abuse, exfiltration — and precision for high-volume commodity detections. F2 and F0.5 exist precisely so you can state which regime a rule is in.
How do I even know my false negatives?
Retrospectively: incidents found by a third party, by an audit, by threat hunting, or by red-team exercises that your rules never flagged. It is always an under-count, so treat measured recall as an optimistic upper bound.