Evaluating Detection Fidelity Without Ground Truth

In most machine learning evaluation problems, the ground truth is available: you have labeled data, you split it into training and test sets, and you measure performance on the test set. In security detection, the most important ground truth — the set of attacks that occurred and were not detected — is precisely what you do not have. An autonomous SOC that misses a sophisticated attack does not generate an alert, so the missed attack does not appear in any alert log. The missed attack may appear in other telemetry — network logs, endpoint events, authentication records — but identifying it as a missed detection requires knowing that an attack occurred, which requires independent ground truth. The measurement paradox: to measure what you missed, you need to know what you missed. This article establishes what evaluation is possible without complete ground truth and what evaluation gaps remain irreducible.

The Ground Truth Problem in Detection Evaluation

Security detection evaluation differs from standard classification evaluation in a fundamental way: the ground truth for the negative class (attacks that did not trigger an alert) is unavailable. In a spam filter, you can label a test corpus manually. In a fraud detection system, you eventually learn which transactions were fraudulent through charge-back records. In security intrusion detection, you do not learn about missed attacks unless you conduct incident response or red-team exercises — and even then, the red-team exercises are limited to what the red team attempted, not the full space of attacks that might be attempted.

Sommer and Paxson (2010) identify the ground truth problem as the fundamental methodological challenge in intrusion detection research: academic evaluations use labeled datasets (KDD Cup 1999, CAIDA, etc.) that do not represent the distribution of real-world attacks, while operational systems cannot be evaluated on real-world attacks because real-world attack ground truth is unavailable. Chandola, Banerjee and Kumar (2009) note the same problem for anomaly detection: anomaly detectors are trained and evaluated in environments where the anomalies of interest are not well-represented in labeled training data.

The practical consequence is that operational autonomous SOC systems are evaluated on proxies — on datasets that approximate the distribution of attacks, on red-team exercises that approximate attacker behavior, and on historical incidents that were eventually detected. Each proxy has known biases. Dataset-based evaluation uses fixed, dated, non-representative attack scenarios. Red-team evaluation is limited by the red team's imagination and technical capability. Historical incident evaluation selects only for detectable attacks (missed attacks, by definition, are not in the historical incident set).

Liang et al. (HELM 2022) develop the concept of holistic evaluation for large language models — measuring performance across diverse scenarios rather than on a single benchmark — which provides a framework applicable to detection system evaluation: instead of a single comprehensive benchmark (which cannot be constructed), use a diverse portfolio of partial evaluations each with known coverage and bias.

Why Standard Metrics Are Insufficient

Precision and recall require both true positives and false negatives — the former available (detected alerts), the latter unavailable (missed attacks). In practice, autonomous SOC systems are evaluated using alert precision (of all alerts generated, what fraction were genuine detections) without an estimate of recall (of all genuine attacks, what fraction generated alerts). This is equivalent to evaluating a medical test by its positive predictive value without estimating its sensitivity — useful but fundamentally incomplete.

False negative rate, the complement of recall, cannot be measured without knowing the total number of attacks. The false negative rate of a detection system is: FNR = missed_attacks / (missed_attacks + true_positives). Since missed_attacks is the unknown quantity, FNR is unmeasurable from operational data alone. Any claim that an autonomous SOC has a low false negative rate is a claim about what it detected, not about what it missed.

Alert volume metrics — the number of alerts generated per day, the fraction of alerts escalated, the mean time to triage — measure operational efficiency but not detection fidelity. A system that generates fewer alerts may have fewer false positives (better alert precision) or may be missing more attacks (lower recall). Alert volume reduction is compatible with both better precision and worse recall; volume metrics cannot distinguish the two cases.

Dwell time — the time between initial compromise and detection — is a commonly reported detection effectiveness metric. But dwell time is measured only for eventually-detected incidents; it is undefined for incidents that are never detected. The reported median dwell time for detected incidents is not the median dwell time for all incidents, because undetected incidents are excluded from the calculation. Dwell time measurements systematically underestimate the detection gap.

The Reference-Free Detection Evaluation Protocol

The reference-free detection evaluation protocol provides structured evaluation coverage without complete ground truth. It combines three complementary methods: adversarial stress-testing, recall proxies, and held-out red-team traces. Each method provides partial, biased coverage; the combination provides a defensible evaluation baseline.

Adversarial stress-testing probes the autonomous SOC with synthetic attack sequences designed to test known detection failure modes. Unlike red-team exercises (which aim to achieve adversary goals), stress-testing aims to expose detection gaps. The protocol defines a structured test suite covering the TTP matrix: for each TTP in scope, at least one synthetic test case exercises the detection boundary — the minimum observable signal that should trigger a detection. Stress-test results yield a binary coverage table: which TTPs have tested detection coverage, and which do not. This is not recall; it is coverage.

Recall proxies use indirect evidence to bound the false negative rate. The canonical recall proxy in security is honeypot instrumentation: deploy canary accounts, credentials, network paths, and documents that will only be accessed if an attacker is active. A honeypot access is a near-certain true positive (no legitimate process accesses honeypots); honeypot silence is a weak signal that no attacker has accessed these resources. Honeypot-based recall estimation gives a lower bound on detection fidelity: if honeypots are not triggering, the environment is either free of attacker activity targeting these resources, or the attacker knows to avoid them.

Held-out red-team traces archive the detailed operational logs from red-team exercises and replay them against the detection pipeline in an isolated evaluation environment. Unlike stress-testing (which uses synthetic events), red-team trace replay uses real attacker behavior recorded from actual exercises. Detection results on red-team trace replay provide recall estimates for the specific attacker profiles and TTPs the red team employed. The limitation: red-team traces cover only what the red team attempted.

Adversarial Stress-Testing: Design and Scope

Adversarial stress-testing for detection evaluation is distinct from red-team exercises and penetration testing. Red-team exercises aim to achieve adversary goals (initial access, lateral movement, data exfiltration) as a test of the overall security posture. Penetration testing aims to identify exploitable vulnerabilities. Adversarial stress-testing aims specifically to identify detection gaps — points in the TTP matrix where the detection pipeline does not fire for known attacker behaviors.

The scope of adversarial stress-testing is defined by the detection TTP matrix: the set of techniques the autonomous SOC is supposed to detect. For each technique, a stress test defines the minimum observable signal that should trigger a detection. For credential-based lateral movement, the minimum observable signal might be: one authentication from account A to host B using credentials that have never been used for that host, followed by process creation on host B that matches a known lateral movement pattern. The stress test injects this signal sequence and verifies that the detection pipeline fires.

The stress-test coverage result is binary: each TTP either has a passing stress test (confirmed detection coverage) or does not (unconfirmed coverage, possibly a detection gap). The binary result does not measure recall; it measures whether the detection pipeline fires for the designed minimum observable signal. An attacker who uses a signal below the detection minimum (evasion) is not covered by the stress test. But confirmed stress-test coverage at least rules out the case where the detection pipeline does not fire at all for a given TTP.

Apruzzese et al. (2023) note that adversarial evaluation is particularly important for machine learning-based detection systems because these systems can be evaded by adversaries who know the model's decision boundary. Stress-testing that approaches the detection boundary (rather than using obvious, high-signal attacks) provides more meaningful coverage evidence.

Limitations

The reference-free protocol provides structured partial evaluation coverage, not equivalent evaluation to complete ground truth. The specific limitations: adversarial stress-testing covers only designed test cases — attacks that fall outside the TTP matrix or use novel techniques not covered by the test suite will not be tested. Recall proxies (honeypots) provide evidence about attacker access to instrumented resources, not about attacker activity on uninstrumented systems. Red-team trace replay covers only the specific attacker profiles and TTPs the red team employed; the red team's capability bounds the evaluation coverage.

The reference-free protocol does not produce a recall estimate — a fraction of attacks detected. It produces evaluation coverage: for which attack types detection has been tested, for which it has not, and what the honeypot monitoring shows. This is an evaluation capability, not an evaluation metric. Communicating the distinction to stakeholders is an organizational challenge: decision-makers want a single recall number; the reference-free protocol provides a structured coverage map instead.

The HELM evaluation framework (Liang et al. 2022) encountered the same challenge in large language model evaluation: providing a holistic multi-scenario evaluation rather than a single performance score required significant stakeholder education about why single-score evaluations are misleading. The same education challenge applies to autonomous SOC evaluation: a coverage map is more honest than a single recall estimate, but less convenient for reporting.

Practitioner Toolkit

Copy-paste, strictly defensive artifacts you can use today. Nothing here attacks a real system.

# Adversarial Stress-Test Harness
# Tests detection coverage at the minimum observable signal boundary
# Run in isolated staging environment — never against production telemetry

class StressTestCase:
    def __init__(self, ttp_id, ttp_name, signal_events, expected_alert_type,
                 max_detection_latency_sec=300):
        self.ttp_id = ttp_id
        self.ttp_name = ttp_name
        self.signal_events = signal_events  # minimum observable signal sequence
        self.expected_alert_type = expected_alert_type
        self.max_latency = max_detection_latency_sec

def run_stress_test(test_case, detection_pipeline, event_injector):
    start_time = time.now()
    # Inject minimum observable signal
    for event in test_case.signal_events:
        event_injector.inject(event)
    # Poll for detection alert within latency window
    while time.now() - start_time < test_case.max_latency:
        alerts = detection_pipeline.get_recent_alerts(since=start_time)
        matched = [a for a in alerts if a.type == test_case.expected_alert_type]
        if matched:
            return StressTestResult(
                ttp=test_case.ttp_id,
                status='PASS',
                latency_sec=(matched[0].timestamp - start_time),
            )
    return StressTestResult(
        ttp=test_case.ttp_id,
        status='FAIL',  # no alert within latency window = detection gap
        latency_sec=None,
    )

# Example: lateral movement TTP minimum observable signal
lateral_movement_test = StressTestCase(
    ttp_id='T1021.001',
    ttp_name='Remote Desktop Protocol lateral movement',
    signal_events=[
        Event(type='auth', account='canary-svc-01', dest_host='canary-host-02',
              protocol='rdp', note='first-ever auth for this pair'),
        Event(type='process_create', host='canary-host-02',
              parent='svchost.exe', child='cmd.exe',
              note='uncommon parent-child pattern'),
    ],
    expected_alert_type='lateral-movement-detected',
    max_detection_latency_sec=300,
)

# Run all TTPs in scope and emit coverage table
results = [run_stress_test(tc, pipeline, injector) for tc in ALL_TTP_TEST_CASES]
pass_rate = sum(1 for r in results if r.status == 'PASS') / len(results)
print_coverage_table(results)  # shows PASS/FAIL per TTP — not recall, but coverage

Glossary

Ground Truth Problem

The fundamental evaluation challenge in security detection: missed attacks are unavailable as labeled data because they never generate alerts, making it impossible to compute recall from operational data alone.

Reference-Free Evaluation Protocol

A structured evaluation approach that estimates detection coverage without complete ground truth, combining adversarial stress-testing, recall proxies (honeypots), and held-out red-team trace replay.

Adversarial Stress-Testing

An evaluation method that probes the detection pipeline with synthetic attack sequences designed to test detection coverage at the TTP boundary — the minimum observable signal that should trigger a detection.

Recall Proxy

An indirect measure used to bound the unobservable false negative rate; the canonical recall proxy in security is honeypot instrumentation, which provides lower bounds on attacker activity detection.

Red-Team Trace Replay

An evaluation method that archives detailed logs from red-team exercises and replays them against the detection pipeline in an isolated environment to measure detection recall for specific attacker profiles.

Evaluation Coverage

A map of which attack types, techniques, and adversary profiles have been evaluated by at least one evaluation method; the honest alternative to a single recall estimate when complete ground truth is unavailable.

Dwell Time Bias

The systematic underestimation of attacker dwell times caused by measuring dwell time only for detected (not missed) incidents; undetected incidents are excluded from the calculation, biasing the reported median downward.

References

1. Sommer & Paxson — Outside the Closed World: On Using Machine Learning for Network Intrusion Detection (IEEE S&P, 2010)
2. Chandola, Banerjee & Kumar — Anomaly Detection: A Survey (ACM Computing Surveys, 2009)
3. Liang et al. — Holistic Evaluation of Language Models (arXiv:2211.09110, 2022)
4. Apruzzese et al. — The Role of Machine Learning in Cybersecurity (Digital Threats: Research and Practice, 2023)
5. NIST AI 100-1: Artificial Intelligence Risk Management Framework (AI RMF 1.0)
6. NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems
7. MITRE ATT&CK: Adversarial Tactics, Techniques, and Common Knowledge
8. OWASP Agentic Security Initiative: Agentic AI Threats and Mitigations (2025)