diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 84a2f9f..cffcc61 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -31,7 +31,7 @@ jobs: - name: Install dependencies run: poetry install - name: Build HTML docs - run: poetry run sphinx-build -M html docs docs/_build -W --keep-going + run: poetry run sphinx-build -M dirhtml docs docs/_build -W --keep-going - name: Upload HTML docs uses: actions/upload-artifact@v3 with: diff --git a/docs/definitions.rst b/docs/definitions.rst index 7d387d3..7a9a8f0 100644 --- a/docs/definitions.rst +++ b/docs/definitions.rst @@ -8,7 +8,7 @@ This page defines the key terms used throughout our research. Precision --------- -**Precision is the ratio of true positives to positive results matched by an analytic.** +**Precision is the fraction of relevant malicious events among all events matched by an analytic.** High precision analytics create fewer false positives. Precision is high at lower levels of the pyramid (e.g. file hashes) but can be challenging for analytics higher on the @@ -19,7 +19,7 @@ pyramid. Recall ------ -**Recall is the ratio of true positives to total events matched by an analytic.** +**Recall is the fraction of malicious events that are matched by an analytic.** High recall analytics are less likely to miss malicious activity. There is often a tradeoff between precision and recall: as one increases, the other decreases. This @@ -30,7 +30,8 @@ getting overwhelmed with false positives. Robustness ---------- -**Robustness measures the effort needed by an adversary to evade an analytic** + +**Robustness measures the effort needed by an adversary to evade an analytic.** Robustness is crucial for the effectiveness of an analytic, and is the focus of the Summiting the Pyramid project. Robustness is directly related to the cost required by an