Differences between precision and recall If you developed two classifiers for an intrusion detection system  (IDS) to detect worms in a network, and the precision and recall are 90% and 40% respectively for the first, and 60% and 80% respectively for the second,
which classifier is better?
 A: Lets assume you need to detect 225 actual worms in your validation set.
The first classifier C1 detects 90 of these correctly but mis-classifies 10 non-worms as worms (false positives), hence it has a precision of:
90% = 90/(90+10)
But since its only caught 90 of the 225, its recall is 90/225 = 40%.
Lets assume the second classifier C2 detects only 180 of these 225 worms correctly, but it mis-classifies 120 non-worms as worms (false positives), hence it has a precision of:
60% = 180/(180+120)
But its recall is 80% since it correctly caught 180 of the 225 worms in the network.
Hence, my opinion is that classifier 2 is better since it is better in reducing the risk to your network, although it also means you have to investigate 110 more false positives than classifier 1. But, you would've caught twice the number of worms than with Classifier 1.
In the end it depends upon how costly it is for the end user to investigate false positives, as compared to the cost of containing and cleaning up after a worm infects the network.
Kindly refer to this neat diagram describing both precision and recall.
