Original practice · fully worked
Original variant: update from disagreeing message filters
One quarter of incoming messages are malicious and the rest are benign. Two filters operate independently after the message type is fixed. Filter 1 alerts on 80% of malicious and 20% of benign messages; Filter 2 alerts on 50% of malicious and 10% of benign messages. A message triggered Filter 1 but not Filter 2. Calculate the probability that it was malicious.
- A
0.1000 - B
0.1800 - C
0.2500 - D
0.4000 - E
0.4255
Answer and calculation
Conditional independence makes the observed alert pattern have likelihood 0.80(0.50)=0.40 for malicious messages and 0.20(0.90)=0.18 for benign messages. Prior-weighting gives masses 0.10 and 0.135, so the malicious posterior is 0.10/0.235=20/47, approximately 0.4255 and choice E.
Setup
Setup
Let R denote the mixed result in which the first filter alerts and the second does not.
Pr(M)=0.25,Pr(B)=0.75 Model
Model
Multiply the two filter factors within each message type using their stated conditional independence.
Pr(R∣M)=0.80(1−0.50)=0.40 Pr(R∣B)=0.20(1−0.10)=0.18 Compute
Compute
Weight the two likelihoods by their priors and normalize the malicious route.
Pr(M∩R)=0.25(0.40)=0.10 Pr(B∩R)=0.75(0.18)=0.135 Pr(M∣R)=0.10+0.1350.10=4720=0.4255319… Answer
Answer
The posterior malicious probability rounds to 0.4255.
0.4255(E)