Threat Alert Prioritization Using Isolation Forest and Stacked Auto Encoder With Day-Forward-Chaining Analysis
Security Incident and Event Manager (SIEM) is a security management approach designed to identify possible threats within a real-time enterprise environment. The main challenge for SIEM is to find critical security incidents among a huge number of less critical alerts coming from separate security p...
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2020-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/9276411/ |
| _version_ | 1818379545074466816 |
|---|---|
| author | Muhamad Erza Aminanto Tao Ban Ryoichi Isawa Takeshi Takahashi Daisuke Inoue |
| author_facet | Muhamad Erza Aminanto Tao Ban Ryoichi Isawa Takeshi Takahashi Daisuke Inoue |
| author_sort | Muhamad Erza Aminanto |
| collection | DOAJ |
| description | Security Incident and Event Manager (SIEM) is a security management approach designed to identify possible threats within a real-time enterprise environment. The main challenge for SIEM is to find critical security incidents among a huge number of less critical alerts coming from separate security products. The continuously growing number of internet-connected devices has led to the alert fatigue problem, which is defined as the inability of security operators to investigate each incoming alert from intrusion detection systems. This fatigue can lead to human errors and leave many alerts being not investigated. Aiming at reducing the number of less important threat alerts presented to security operators, this paper presents a new method for highlighting critical alerts with a minimal number of false negatives. The proposed method employs isolation forest to ensure unsupervised performance and adaptability to different types of networks. Furthermore, it takes the advantage of day-forward-chaining analysis to ensure the detection of highly important alerts in real time. The number of false positive cases is reduced by employing an autoencoder. The proposed method achieved a recall score of 95.89% and a false positive rate of 5.86% on a dataset comprising more than half a million alerts collected in a real-world enterprise environment over ten months. This study highlights the importance of addressing the alert fatigue problem and validates the effectiveness of unsupervised learning in filtering out less important threat alerts. |
| first_indexed | 2024-12-14T02:04:29Z |
| format | Article |
| id | doaj.art-fb247dea6edf43b0916746f587ab757f |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-12-14T02:04:29Z |
| publishDate | 2020-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-fb247dea6edf43b0916746f587ab757f2022-12-21T23:20:55ZengIEEEIEEE Access2169-35362020-01-01821797721798610.1109/ACCESS.2020.30418379276411Threat Alert Prioritization Using Isolation Forest and Stacked Auto Encoder With Day-Forward-Chaining AnalysisMuhamad Erza Aminanto0https://orcid.org/0000-0001-5614-2276Tao Ban1Ryoichi Isawa2Takeshi Takahashi3https://orcid.org/0000-0002-6477-7770Daisuke Inoue4National Institute of Information and Communication Technology, Tokyo, JapanNational Institute of Information and Communication Technology, Tokyo, JapanNational Institute of Information and Communication Technology, Tokyo, JapanNational Institute of Information and Communication Technology, Tokyo, JapanNational Institute of Information and Communication Technology, Tokyo, JapanSecurity Incident and Event Manager (SIEM) is a security management approach designed to identify possible threats within a real-time enterprise environment. The main challenge for SIEM is to find critical security incidents among a huge number of less critical alerts coming from separate security products. The continuously growing number of internet-connected devices has led to the alert fatigue problem, which is defined as the inability of security operators to investigate each incoming alert from intrusion detection systems. This fatigue can lead to human errors and leave many alerts being not investigated. Aiming at reducing the number of less important threat alerts presented to security operators, this paper presents a new method for highlighting critical alerts with a minimal number of false negatives. The proposed method employs isolation forest to ensure unsupervised performance and adaptability to different types of networks. Furthermore, it takes the advantage of day-forward-chaining analysis to ensure the detection of highly important alerts in real time. The number of false positive cases is reduced by employing an autoencoder. The proposed method achieved a recall score of 95.89% and a false positive rate of 5.86% on a dataset comprising more than half a million alerts collected in a real-world enterprise environment over ten months. This study highlights the importance of addressing the alert fatigue problem and validates the effectiveness of unsupervised learning in filtering out less important threat alerts.https://ieeexplore.ieee.org/document/9276411/Threat alert fatiguestacked autoencoderisolation forestintrusion detection system |
| spellingShingle | Muhamad Erza Aminanto Tao Ban Ryoichi Isawa Takeshi Takahashi Daisuke Inoue Threat Alert Prioritization Using Isolation Forest and Stacked Auto Encoder With Day-Forward-Chaining Analysis IEEE Access Threat alert fatigue stacked autoencoder isolation forest intrusion detection system |
| title | Threat Alert Prioritization Using Isolation Forest and Stacked Auto Encoder With Day-Forward-Chaining Analysis |
| title_full | Threat Alert Prioritization Using Isolation Forest and Stacked Auto Encoder With Day-Forward-Chaining Analysis |
| title_fullStr | Threat Alert Prioritization Using Isolation Forest and Stacked Auto Encoder With Day-Forward-Chaining Analysis |
| title_full_unstemmed | Threat Alert Prioritization Using Isolation Forest and Stacked Auto Encoder With Day-Forward-Chaining Analysis |
| title_short | Threat Alert Prioritization Using Isolation Forest and Stacked Auto Encoder With Day-Forward-Chaining Analysis |
| title_sort | threat alert prioritization using isolation forest and stacked auto encoder with day forward chaining analysis |
| topic | Threat alert fatigue stacked autoencoder isolation forest intrusion detection system |
| url | https://ieeexplore.ieee.org/document/9276411/ |
| work_keys_str_mv | AT muhamaderzaaminanto threatalertprioritizationusingisolationforestandstackedautoencoderwithdayforwardchaininganalysis AT taoban threatalertprioritizationusingisolationforestandstackedautoencoderwithdayforwardchaininganalysis AT ryoichiisawa threatalertprioritizationusingisolationforestandstackedautoencoderwithdayforwardchaininganalysis AT takeshitakahashi threatalertprioritizationusingisolationforestandstackedautoencoderwithdayforwardchaininganalysis AT daisukeinoue threatalertprioritizationusingisolationforestandstackedautoencoderwithdayforwardchaininganalysis |