Cybercrimes with Confusion Matrices

Confusion Matrix and Cybercrime

In the world of Machine Learning, a confusion matrix is a box that visualizes the accuracy of a model. It is an n x n matrix where n is a number of different classes, which is 2 in the case of binary classification. It is known as a confusion matrix because of the fact that the classifier gets “confused” in predicting correct labels in the case of an unbalanced dataset.

We consider positive and negative to be right and wrong respectively.

Now for example, if a model were to predict if an image was of a cat or not, it either can give you a true value that matches the ground truth, or a false value that does not match the ground truth. In either case, it is a positive value if it is a cat and a negative value otherwise.

Source: Confusion Matrices & Interpretable ML by andrea b

• True Positive: When the predicted value matches the ground truth and is positive.
• False Positive: When the predicted value is positive and the ground truth is negative.
• False Negative: When the predicted value is negative and the ground truth is positive.
• True Negative: When predicted value matches the ground truth and is negative.

Confusion Matrices can be used to derive some important metrics like accuracy, precision, misclassification rate, and recall.

• Accuracy: (TP +TN)/(TP+TN+FP+FN)
• Misclassification rate: (FP+FN)/(TP+TN+FP+FN)
• Precision: (TP)/(TP+FP)
• Recall: (TP)/(TP+FN)

Both the false values are known as errors, false positive being a type 1 error and false negative being a type 2 error.

Type 1 error is considered the most dangerous kind of error, and type 2 is considered to be a false alarm. With this knowledge, many minds have carried out cybercrimes over the years. Let's understand these errors one by one:

What Are False Positives?

False-positive labels are security alerts, indicating that there is indeed a threat, when in fact it is not. For example, if there is a bug in a system, such an alert would indicate the system to be bug-free when in reality that is not true and the system could be in some critical phase. It basically occurs when one rejects a true null hypothesis and hence is more dangerous.

What Are False Negatives?

These occur when one accepts a false null hypothesis.

Cybercrime investigations:

Incomplete blog