Explanation
The Bernoulli distribution models the outcome of a single random experiment with exactly two possible outcomes: success (X = 1) with probability p, and failure (X = 0) with probability 1 − p. It is the most elementary discrete distribution and serves as the building block for other distributions: the sum of n independent Bernoulli trials with the same p gives rise to the binomial distribution. It applies whenever an observation is of the yes/no type: a customer buys or doesn't buy, a component fails or doesn't fail, an email is spam or isn't. Its mean is p and its variance is p(1 − p), which reaches its maximum at p = 0.5.
Formula
\( P(X=k)=p^{k}(1-p)^{1-k},\quad k\in\{0,1\} \)
Parameters
- p: probability of success, with 0 ≤ p ≤ 1.
- x: only takes the values 0 (failure) or 1 (success).
Worked example
Situation: An intrusion detection system analyzes each network packet independently. The probability that a packet is malicious is \(p = 0.7\) on a network under attack. We model the classification of a single packet as a Bernoulli trial with \(p = 0.7\).
Question 1: What is the probability that the packet is malicious, \(P(X = 1)\), and what is the probability that it is benign, \(P(X = 0)\)?
Solution: Directly from the definition of the Bernoulli distribution: \[ P(X = 1) = p = 0.7 \qquad P(X = 0) = 1 - p = 0.3 \] There is a 70% probability that the packet is malicious and a 30% probability that it is benign.
Question 2: What are the expected value and variance of this single trial?
Solution: For the Bernoulli distribution with parameter \(p\): \[ E[X] = p = 0.7 \] \[ \text{Var}(X) = p(1-p) = 0.7 \times 0.3 = 0.21 \] The expected value \(E[X] = 0.7\) is interpreted as meaning that, on average, 70% of packets are malicious. The variance \(\text{Var}(X) = 0.21\) measures the uncertainty of a single trial; it is maximized when \(p = 0.5\).
Interpretation: The Bernoulli distribution is the fundamental building block of all discrete statistics: when repeating \(n\) independent identical trials, the sum of the outcomes follows a Binomial(\(n, p\)) distribution. In this case, if 100 packets are analyzed, the total number of malicious ones would follow a Binomial(100, 0.7) with mean \(100 \times 0.7 = 70\) packets.