WOCI: Weighted Operational Cost Index A New Evaluation Metric for Intrusion Detection - Quincozes, Vagner E.; Quincozes, Silvio E.; Albuquerque, Célio; Passos, Diego; Mossé, Daniel (Anais do Simpósio Brasileiro de Cibersegurança (SBSeg), 2026)
This paper proposes the Weighted Operational Cost Index (WOCI), a post-hoc metric for evaluating binary detection configurations under asymmetric error costs. WOCI combines averaged counts of false positives and false negatives through a configurable cost ratio R = CFN/CFP , normalized by the number of positive instances. We instantiate WOCI in an Intrusion Detection System (IDS) case study using the ERENO and 5G-NIDD datasets with CatBoost and XGBoost, comparing configurations from Built-in importance, SHAP, and Mutual Information across multiple feature subset sizes. Results show that 13 of 20 configurations keep the same preferred strategy across R ∈ [1, 100], while seven change at a crossover point R ∗ . The main transitions occur in 5G-NIDD with XGBoost near R ≈ 10, a plausible enterprise cost scenario.