Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces a novel alert prioritization framework for intrusion detection systems (IDS) that uses subnormal Gaussian fuzzy numbers to model uncertainty in threat severity, detection confidence, and organizational risk attitude. The framework represents each alert as a fuzzy number and uses ranking indices to prioritize alerts based on a tunable risk-attitude parameter. Experiments on CIC-IDS2017 and NSL-KDD datasets demonstrate that the proposed approach achieves greater robustness under detector degradation compared to baselines, as measured by NDCGrel@100.
Even when intrusion detection systems degrade, this new fuzzy-logic approach maintains high alert prioritization accuracy, outperforming baselines by a large margin.
Modern intrusion detection systems generate thousands of alerts daily, but alert fatigue severely limits security operations effectiveness due to too many false positives or low-impact events. We address this by proposing a principled framework for alert prioritization based on subnormal Gaussian fuzzy numbers, explicitly modeling three sources of uncertainty: threat severity, detection confidence, and organizational risk attitude. Each alert is represented as a fuzzy number with the core indicating severity, spread indicating uncertainty, and height reflecting detection reliability. We apply ranking indices to prioritize alerts, allowing organizations to tune security posture through a risk-attitude parameter. Experimental validation on CIC-IDS2017 and NSL-KDD demonstrates greater robustness than baselines under detector degradation (0.9963 vs 0.8215 NDCGrel@100), with distinct differentiation in mid-confidence alerts and near-parity with baselines under robust detectors. The framework is theoretically grounded, computationally efficient, provides interpretable reasoning, and remains robust across detector families and miscalibration scenarios.