liveBook · Manning

Recall

As explained in Data-Driven Cybersecurity

Recall is the proportion of actual instances in a class that a classification model correctly identifies.

Recall measures how many actual instances of a class a classifier identifies correctly. High recall means it captures most real high-risk articles or threats. section 12.4.1 section 12.5.1

Use recall to assess whether a model misses real threats. Interpret it alongside false negatives and other performance measures: a strong overall accuracy can still accompany missed threats. section 12.5.1

              precision    recall  f1-score   support

           0       0.63      1.00      0.77       126
           1       1.00      0.00      0.00        74

    accuracy                           0.63       200
   macro avg       0.81      0.50      0.39       200
weighted avg       0.77      0.63      0.49       200

The report shows class 1 recall of 0.00 across 74 cases, despite overall accuracy of 0.63—a result that calls for attention to missed cases. section 12.5.1

How Data-Driven Cybersecurity covers it

How deep it goes
Interprets class-specific recall in classification reports alongside precision, F1-score, accuracy, and confusion matrices.
Examples
Uses cybersecurity articles, network traffic, and login activity to interpret class-specific recall.
What you can do after
Evaluate whether a classifier detects actual threats by reading class-specific recall alongside false negatives and other performance measures.
How it connects
Connects recall with precision, F1-score, accuracy, confusion matrices, and false negatives.

Also explained in

Compare how 24 books explain recall →

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Data-Driven Cybersecurity. The section links point to the parts of the book it draws on.