[zxv]

Great point. This is the effect of a low base-rate.

https://en.wikipedia.org/wiki/Base_rate_fallacy

Here's a paper on it's impact on network intrusion detection.

http://www.raid-symposium.org/raid99/PAPERS/Axelsson.pdf

[itchytrotters]

Bruce Schneier has pointed out the implications of the base rate fallacy for various security systems for a long time now:

https://www.schneier.com/blog/archives/2006/03/data_mining_f...

https://www.schneier.com/blog/archives/2006/07/terrorists_da...

https://www.schneier.com/blog/archives/2012/05/criminal_inte...