Poisson Distribution and Counting Rare Events

The Poisson distribution models how many times an event occurs in a fixed interval of time or space, when events happen independently at a steady average rate. Typical uses include failed logins per hour, defects per batch, or support tickets per day.

P(X = k) = (e⁻λ × λᵏ) / k!

• λ (lambda): the average number of events per interval. It is both the mean and the variance of the distribution.
• k: the exact number of events you are asking about.
• e: a constant, approximately 2.718.
• k!: k factorial, the product of all whole numbers from 1 up to k.

Because the mean equals the variance, a count column whose variance is far larger than its mean does not fit a Poisson model well.

Binomial or Poisson

Example: A server logs an average of 3 failed logins per hour. Find the probability of exactly 5 failed logins in an hour, and of at least one.

1. P(X = 5) = (e⁻³ × 3⁵) / 5! = (0.0498 × 243) / 120 ≈ 0.1008
2. P(X = 0) = e⁻³ ≈ 0.0498
3. P(at least one) = 1 − 0.0498 = 0.9502

There is about a 10% chance of exactly 5 failed logins and a 95% chance of at least one. An alert that triggers on unusually high counts can be set using the upper tail of this distribution.