True Positive Rate Calculator
Derive recall, precision, F1, specificity and balanced accuracy from a detection confusion matrix.
About True Positive Rate Calculator
Recall and precision trade against each other: loosening a rule catches more real activity and more noise at the same time. The F-measure collapses that trade-off into one number, and balanced accuracy averages recall with specificity so the vast benign population cannot flatter the score. Plain accuracy is meaningless in security because the negative class dominates — a rule that alerts on nothing scores 99.9% accuracy and detects zero intrusions. Recall, precision and F-measure are what actually describe a detection.
Formulas
True Positive Rate
Recall = TP ÷ (TP + FN). Precision = TP ÷ (TP + FP). Specificity = TN ÷ (TN + FP).
- TP
- Correctly alerted malicious activity
- FN
- Malicious activity that produced no alert
- FP
- Benign activity that produced an alert
- TN
- Benign activity correctly ignored
F-measure
Fβ = (1 + β²) × precision × recall ÷ (β² × precision + recall), so F1 is the harmonic mean and F2 weights recall four times as heavily.
- β
- Weighting factor — 1 balanced, 2 recall-favouring, 0.5 precision-favouring
Worked example
With the default values below, True Positive Rate Calculator returns True Positive Rate (Recall) of 84.00%. Change any input above and every figure here is recalculated in your browser.
Inputs used
- True positivesaccepts 0–1,000,000 alerts
- 42 alerts
- False negatives (missed detections)accepts 0–1,000,000 incidents
- 8 incidents
- False positivesaccepts 0–1,000,000 alerts
- 210 alerts
- True negativesaccepts 0–1,000,000,000 events
- 185,000 events
- F-measure weightingone of F1 — precision and recall equally, F2 — recall twice as important, F0.5 — precision twice as important
- F1 — precision and recall equally
Results
- True Positive Rate (Recall)
- 84.00%
- Precision
- 16.67%
- F-Measure
- 0.2781 0–1
- Specificity (True Negative Rate)
- 99.8866%
- Balanced Accuracy
- 91.94%
- Miss Rate (False Negative Rate)
- 16.00%
- Detection Quality Verdict
- Adequate recall — the misses are where the risk sits
Step by step
- 1Values used
- 2True Positive Rate
- 3F-measure
- 4True Positive Rate (Recall)= 84.00
- 5Precision= 16.67
- 6F-Measure= 0.2781 0–1
- 7Specificity (True Negative Rate)= 99.8866
- 8Balanced Accuracy= 91.94
- 9Miss Rate (False Negative Rate)= 16.00
Assumptions and limits
- The result is derived only from the 5 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 4 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is True Positive Rate calculated?
Recall = TP ÷ (TP + FN). Precision = TP ÷ (TP + FP). Specificity = TN ÷ (TN + FP). Recall and precision trade against each other: loosening a rule catches more real activity and more noise at the same time. The F-measure collapses that trade-off into one number, and balanced accuracy averages recall with specificity so the vast benign population cannot flatter the score.
Why does True Positive Rate matter?
Plain accuracy is meaningless in security because the negative class dominates — a rule that alerts on nothing scores 99.9% accuracy and detects zero intrusions. Recall, precision and F-measure are what actually describe a detection.
What values do I need to enter?
This calculator takes 5 inputs: True positives, False negatives (missed detections), False positives, True negatives, F-measure weighting. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Should I optimise for recall or precision?
Recall first for anything on the critical path of a serious intrusion — ransomware staging, domain-admin abuse, exfiltration — and precision for high-volume commodity detections. F2 and F0.5 exist precisely so you can state which regime a rule is in.
How do I even know my false negatives?
Retrospectively: incidents found by a third party, by an audit, by threat hunting, or by red-team exercises that your rules never flagged. It is always an under-count, so treat measured recall as an optimistic upper bound.