Interactive Lab

Threshold Tuning Explorer

A malware classifier outputs a probability, not a verdict. The decision thresholdconverts that score into “malware” or “benign” — and where you place it decides the trade-off between catching threats and raising false alarms. Drag the threshold below and watch the confusion matrix respond. Distributions mirror a balanced CIC-MalMem-2022 split (58,596 samples); the model is the ANN baseline from my MSc dissertation.

Classifier score distribution

BenignMalwareFalse positiveFalse negative

Decision threshold0.50

Confusion matrixthreshold 0.50

Pred. malware

Pred. benign

Actual malware

26,720True positive

2,578False negative

Actual benign

1,126False positive

28,172True negative

Detection rate (TPR)91.2%

False-positive rate3.8%

Precision96.0%

F1 score93.5%

Accuracy93.7%

ROC curveAUC 0.985

The dot is your current operating point. Sliding the threshold walks it along the curve — up-left means fewer false alarms, down-left means missed malware.