Hi there,

I apply data mining to Intrusion detection data (Mine the network traffic and classify them if the connection is intrusive (attacks) or normal). A ROC diagram shows the relationship/trade off between detection rate and false alarm rate. + Detection rate = correctly detected attack / total + False alarm = normal but wronly detected as attack / total

My question is that for each MODEL, we can calculte ONE pair of detection rate and false alarm rate. So to build a ROC curve (with multiple data points / pairs of detection and false alarm rate), do I have to build many MODELS? OR there is a THIRD VARIABLE that I can vary it to generate NEW pairs of detection and false alarm rate WITHOUT building new models?

Thanks Patrick Tran PS: I dont know how to use SAS to draw ROC, do it manually seems too hard

--------------------------------- Start your day with Yahoo! - make it your home page