Great point. This is the effect of a low base-rate.
https://en.wikipedia.org/wiki/Base_rate_fallacy
Here's a paper on it's impact on network intrusion detection.
https://en.wikipedia.org/wiki/Base_rate_fallacy
Here's a paper on it's impact on network intrusion detection.
https://www.schneier.com/blog/archives/2006/03/data_mining_f...
https://www.schneier.com/blog/archives/2006/07/terrorists_da...
https://www.schneier.com/blog/archives/2012/05/criminal_inte...