When you added the Anomaly Override layer, how did it affect the false positive rate? Specifically, did it increase or decrease the number of false alarms, and by what percentage compared to the standard ensemble model?
That is a very insightful question. In our framework, the addition of the Anomaly Override layer was primarily designed to minimize critical false negatives, which we consider the highest risk in malware detection.
Regarding the False Positive Rate, we observed that it remained stable and exceptionally low. As you can see from our confusion matrix on Slide 16, the system correctly identified almost all benign samples, with only one misclassification in that category.
The reason we didnt see an increase in false alarms is due to the tuning of our Isolation Forests contamination parameter. By setting it to strictly target extreme statistical outliers, the override acts as a precise priority interrupt rather than a broad filter, allowing us to achieve an overall F1-score of 0.91 and a 91.49% accuracy.
