Normal Is a Moving Target: Baselines, UEBA, the Base-Rate Fallacy, and How AI Security Tools Decide Something Is Wrong

Supervised or unsupervised detection

Which learning approach a tool uses is decided by what data exists, and the exam tests the match.

Supervised detection trains on examples labeled as malicious or benign and learns to classify new events into those classes. It is precise on the classes it was taught and blind to everything else. Fraud detection is the flagship because a bank has years of labeled outcomes: every chargeback is a label. Spam and malware classification work the same way.

Unsupervised detection trains on unlabeled data and finds structure by itself: clusters of similar behavior and the outliers that belong to none. It needs no examples of the attack, which is exactly why it is the engine under UEBA and novel-threat detection, and why it produces more false positives: an outlier is a statistical fact, not a verdict.

Semi-supervised is where most SOC models end up. Analysts' verdicts on a few thousand alerts become labels, millions of unlabeled events supply the structure, and the model improves as the review loop runs. Labeled history and named classes in the stem mean supervised; no labels or an unknown threat mean unsupervised; a few analyst-confirmed cases and a flood of raw telemetry mean semi-supervised.

Four outcomes, two mistakes

Every detection produces one of four outcomes. A true positive is a real threat flagged. A true negative is a benign event left alone. A false positive is a benign event flagged, which costs analyst time and, at volume, credibility. A false negative is a real threat missed, which costs whatever the threat was after. The guide's verdict is blunt: in security, false negatives are usually more dangerous. But false positives are what kill a tool, because a queue nobody trusts is a queue nobody reads, and the missed threat is in it somewhere.

A model that labels everything benign scores 99.99% accuracy on a network where one event in ten thousand is malicious, and catches nothing. On imbalanced data, accuracy measures the size of the benign majority, not the quality of the detector. Precision and recall pull in opposite directions, and the threshold that trades one for the other is a business decision. A declined honeymoon dinner is a false positive with a customer attached.

The base-rate fallacy, with real numbers

Here is the calculation the exam most wants you to do in your head. A network generates one million events a day. One hundred are malicious, a base rate of one in ten thousand. A detector is "99% accurate" in the sense vendors mean: it catches 99% of attacks (recall) and correctly clears 99% of benign events (a 1% false-positive rate).

• Of the 100 attacks, it flags 99: 99 true positives, 1 false negative.
• Of the 999,900 benign events, it wrongly flags 1%: 9,999 false positives, 989,901 true negatives.
• Accuracy: (99 + 989,901) out of 1,000,000, which is 99.0%. The number on the slide is true.
• Precision: 99 real alerts among 10,098 raised, which is 0.98%. Ninety-nine of every hundred alerts are wrong.

The fallacy is assuming a 99% detector produces alerts that are 99% likely to be real. At a base rate of one in ten thousand, the false-positive rate dominates: cut it to 0.1% and precision only reaches about 9%; cut it to 0.01%, one wrong call in ten thousand benign events, and precision finally reaches 50%. No single-stage detector manages that on raw telemetry, which is why the guide's triage pipeline stacks stages. Signature matching clears the known 80%, anomaly detection flags deviations, pattern recognition correlates them into cases, and each stage raises the base rate of the population the next one sees. By the time a human reads a case, the odds are no longer one in ten thousand.

Drift: when normal moves

A baseline is a snapshot of a world that changes. Drift is the gap that opens between what the model learned and what is now true. It arrives from the business (a new office, a migration, remote work, an application that talks to everything), from the season (quarter-end volumes, holidays) and from the adversary (fraud rings that probe thresholds and structure transactions to stay under them). It shows up as both mistakes at once: false positives spike because ordinary new behavior is outside the old band, and false negatives creep in because attacker behavior has been slowly absorbed into it.

The control is retraining, and the exam cares about how, not just whether. Retrain on a schedule and when a known change happens, validate the new model on fresh labeled outcomes rather than on the data it just learned from, and watch precision over time as the signal that drift has begun. The guide's example is the data-center migration: the SOC expects a week of noise while the models relearn normal, and plans for it. And review what the retrained baseline absorbed, because a window that includes an active intrusion has just made the intrusion normal. Continuous monitoring of the model itself turns drift from a surprise into a scheduled event.

The human review loop

The line the guide repeats in every use case is the one the exam repeats in every stem: AI output is a lead, not a verdict. Anomaly detection surfaces what is unusual; a person decides what is real. The loop has three parts. The pipeline orders the stages so that humans see cases, not events. The verdicts analysts give flow back as labels, the semi-supervised learning that makes the next version better. And the threshold is set by people who own the consequences: the fraud team decides how many honeymoon dinners it will decline to catch one more stolen card, and the SOC lead decides how many alerts a shift can read, the triage math that turns forty thousand alerts into a handful. Any action with a blast radius, blocking an account, isolating a host, reversing a payment, is proposed by the model and approved by a person.

Four stems, decoded

1. The week after a data-center migration, a UEBA tool raises ten times its normal alert volume across hundreds of hosts. Drift, a stale baseline. Re-baseline and expect noise while it relearns; this is not a compromise.
2. A vendor quotes 99.5% accuracy for a detector on a network where 0.1% of events are malicious, and the SOC lead asks whether analysts can keep up. Base-rate fallacy. Ask for precision and the false-positive rate at the deployed threshold; accuracy on imbalanced data says nothing about the queue.
3. A bank holds years of labeled chargeback outcomes and wants to score card transactions in real time. Supervised learning for fraud detection, with continuous retraining on fresh labeled outcomes because the adversary adapts.
4. A service account authenticates from a new country at 03:00; no signature matches and the SIEM flags it. Anomaly detection has produced a lead. A human validates before any automated action, and the finding becomes a label either way.

AI-enabled security tools are objective 3.1 of SecAI+ Domain 3, AI-assisted Security, 24% of the exam. The tool categories and the full use-case list are in the Domain 3 overview; this post is the detection half. Work all 18 Domain 3 topics, from the tool landscape through AI-enabled attacks and SOC automation, with our SecAI+ Domain 3 study guide.

#SecAIplus #CY0001 #AnomalyDetection #UEBA #BaseRateFallacy #PrecisionRecall #ModelDrift #SecurityOperations #InfoSec #CyberSecurity