CyberCertPrepAI Security FundamentalsAI & ML Concepts for SecurityEASYFree question
A machine learning engineer explains that their malware classification model uses a 'confusion matrix' for evaluation. In a binary malware/benign classifier, which cell of the confusion matrix represents the most dangerous error type in a production endpoint security context?
- A.A. True Positive: malware flagged as malware
- B.B. True Negative: benign file correctly identified as benign
- C.D. False Positive: benign file flagged as malware - causes analyst workload but no security gap
- D.C. False Negative: malware file misclassified as benign - the model fails to detect a real threat
Why D is correct
In a confusion matrix: True Positives and True Negatives are correct classifications. False Positives (benign flagged as malware) cause analyst alert fatigue and potential disruption to legitimate software. False Negatives (malware classified as benign) are the most dangerous error in a security context - they represent undetected threats that reach the endpoint, potentially enabling infection, data breach, or ransomware execution. Security ML evaluation must prioritize minimizing false negatives (maximizing recall) while keeping false positives manageable.
Know someone studying for AI Security Fundamentals? Send them this one.