Abstract
Machine learning has become an important part of cybersecurity for detecting malware, fraud, intrusions, phishing, and multiple other threats. The ML systems also face challenges with false alarms (false positives) and missing detections (false negatives), which can significantly impact the effectiveness of the Security Operations Centers (SOCs). In this paper, a detailed analysis is done of the challenges that are associated with false positives and false negatives in ML-based threat detection, while exploring the root causes and the possible mitigation strategies. The data quality issues will be examined, such as the label noise, rare event imbalance, and evolving attack patterns. Also, several model-level strategies, which include the probability calibration, cost-sensitive learning, anomaly detection methods, threshold tuning, monitoring models in production, uncertainty estimation, and adversarial robustness. The operational best practices will also be discussed, which include the evolution metrics, creating feedback loops with analysts, monitoring models in production, integrating incident response processes, and incorporating human oversight. These practices ensure that robust deployment of machine learning systems, real-world examples from the industry, such as Intrusion Detection Systems (IDS), SOCs, email phishing detection, and fraud detection, illuminating the trade-offs that are involved and the lessons learned from various implementations. Furthermore, limitations will be addressed, ethical and regulatory concerns, and the potential ways in which the attackers might exploit the mitigation of the false positives and false negatives. This outlines the various mitigation methods, which highlight the trade-offs which are related to complexity, data requirements, and the typical impact on false positives and false negatives. Recommendations are offered, such as adapting to the multi-layered systems, fostering continuous learning, and interfacing explainable AI (XAI) approaches along with future research directions. This report aims to serve as a guide for security stakeholders dealing with ML-driven false positives and false negatives.