Is my application of Bayes' Theorem here correct? I am new to Bayes' theorem and like many others, am having a hard time wrapping my head around it. Here's a question that I am trying to answer:
Question:
Imagine there's a bot detection tool that identifies a rare automated attack:

*

*Only 1 in 100,000 website visits involve the type of attack this tool detects

*The tool will correctly classify the automated attack 100% of the times when the attack is occurring

*The tool incorrectly classifies 0.01% of site visits as involving the attack type when it is not occurring i.e. false positive rate

If the tool classifies the random site visit as this rare attack, what is the probability that the attack is actually occurring?
My approach:
I am referring to this article on Bayes' theorem. My approach is to plug values in this formula:
P(A|X) = P(X|A) * P(A) / (P(X|A)*P(A) + P(X|~A)*P(~A) )

Assuming X is the event of detection and A is the event of attack. My values would be:
P(A) = 0.00001, since that's the number of times the attack happens
P(~A) = 0.99999
P(X|~A) = 0.0001 i.e the false positive rate
P(X|A) = 1
Plugging these values in, I get the answer: 0.090909917 or 9.09%. Somehow this seems far too low and I am not sure if there's an error in my calculations. Could someone kindly highlight if there's an error here?

Given that:
$$
A= "\text{the request is an attack}"\\
X= "\text{antivirus detected it}"\\
$$
then the probability is given by:
$$
\begin{align*}
P(A|X)&= \frac{P(X|A)P(A)}{P(X)}\\
&= \frac{P(X|A)P(A)}{P(X|A)P(A)+P(X|A^c)P(A^c)}\\
&=\frac{1\cdot0.00001}{1\cdot0.00001 + 0.0001\cdot0.99999}\\
&\approx 9.09\%
\end{align*}
$$
Therefore your calculation is correct.
you classifier/antivirus looks good if taken individually, however, when you actually see that you have a ton of request that are "no attacks" that your antivirus will mark them as "attack", the fact that it has $0.01%$ false positive rate, makes the prediction very uncertain
In other words, if you take all the requests that your antivirus will mark as "attack", you will have a lot of false positive
... and this is not because your antivirus is bad, but just because you have a lot of "normal" request
Which is the whole point of Bayes theorem, in other words, you should also consider your prior in the calculation of the probability
