I apply data mining to Intrusion detection data (Mine the network traffic and classify them if the connection is intrusive (attacks) or normal).
A ROC diagram shows the relationship/trade off between detection rate and false alarm rate.
+ Detection rate = correctly detected attack / total
+ False alarm = normal but wronly detected as attack / total
My question is that for each MODEL, we can calculte ONE pair of detection rate and false alarm rate. So to build a ROC curve (with multiple data points / pairs of detection and false alarm rate), do I have to build many MODELS? OR there is a THIRD VARIABLE that I can vary it to generate NEW pairs of detection and false alarm rate WITHOUT building new models?
PS: I dont know how to use SAS to draw ROC, do it manually seems too hard
Start your day with Yahoo! - make it your home page