Determining Optimal Ranges

Decision Theory Question

An organization uses a spam filtering software to block potentially spam messages. The spam filter can be set to one of three security modes: High-Security-Mode (H), Moderate-Security-Mode (M), or Low-Security-Mode (L).

Extensive experimentation using a benchmark corpus of spam messages yields the following performance statistics for the spam filter:
• 98% of the spam messages are blocked in the High-Security-Mode.
• 90% of the spam messages are blocked in the Moderate -Security-Mode.
• 80% of the spam messages are blocked in the Low-Security-Mode.

Extensive experimentation using a benchmark corpus of non-spam (legitimate) messages yields the following performance statistics for the spam filter:
• 12% of the non-spam messages are blocked in the High-Security-Mode
• 8% of the non-spam messages are blocked in the Moderate -Security-Mode
• 5% of the non-spam messages are blocked in the Low-Security-Mode

There are costs associated with not blocking spam messages and blocking non-spam messages.

(a)
The organization estimates that 75% of all messages it receives are spam messages. If the cost of not blocking a spam message is $1, under what ranges of the cost of blocking a non-spam message is each security mode the optimal choice for a rational (risk neutral) information assurance manager? Fill up the ranges in the table below.

Optimal choice When cost of blocking a non-spam message is in the range
High-Security-Mode
Moderate-Security-Mode
Low-Security-Mode

(b)
The organization notices over time that the proportion of spam messages that it receives are declining (i.e., less that 75% of the messages are spam messages). It estimates the cost of blocking a non-spam message as $20. How high must the proportion of spam messages be for a rational (risk neutral) information assurance manager to use the spam filter? Alternately, at least how low should the proportion of spam messages be for the information assurance manager to prefer the policy of not using the spam filter at all? Assume that all the other parameters remain the same as in part (a).