Beginning Anomaly Detection Using

receiver operating 

characteristic curve, or ROC curve. From the area under the curve, or AUC (you 

may see this called 

area under the curve of the receiver operating characteristic, or 

AUROC), a data point, meaning the probability of the model to have a true positive or 

true negative case. This curve can also be called an 

AUCROC curve.

ROC curve with AUC = 1.0 (Figure 

2-3

).

Chapter 2   traditional Methods of anoMaly deteCtion

---

30

This is the most ideal AUC curve. However, it is nearly impossible to attain, so a goal 

of AUC > 0.95 is most desirable. The closer we can get the model to attaining a value of 

1.0 for the AUC, the more the probability of the model to predict a true positive or true 

negative case. The AUC value in the graph above indicates that this probability is 1.0, 

meaning it predicts it correctly 100% of the time. However, an extremely high AUC value 

of say 0.99999 could indicate that the model is 

overfitting, meaning it’s getting really 

good at predicting labels for this particular data set. You will explore this concept a bit 

further in the context of support vector machines, but you want to avoid overfitting as 

much as possible so that the model can perform well even when introduced to new data 

that includes unexpected variations.

It is important to mention that although the AUC can be 0.99, for example, it is not 

guaranteed that the model will continue to perform at that high of a level outside of 

the