Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper systematically evaluates risk-based alerting (RBA) as a solution to cybersecurity alert fatigue by reformulating it into a continuous alert prioritization problem. Through a novel experimentation suite called CATS, the authors distill five fundamental risk hypotheses and assess their effectiveness across eight diverse alert datasets, revealing that specific combinations of these hypotheses significantly enhance alert prioritization performance. The findings indicate that RBA can dramatically reduce false alerts, thereby alleviating the burden on security analysts and providing a robust baseline for future alert triage methods.
Certain combinations of risk hypotheses in RBA can boost alert prioritization performance to an impressive AUROC of 0.92, far surpassing traditional methods.
Security operations centers (SOCs) face large numbers of false alerts, making detection of cyberattacks difficult under typical resource constraints. Risk-based alerting (RBA) has been proposed as a means to reduce false alerts and has reportedly succeeded in doing so in various enterprise deployments. However, RBA has not been comprehensively evaluated until now, leaving implementation mostly guesswork based on anecdotal evidence. In this paper, we present the first systematic evaluation of RBA. To this end, we reformulate it as a continuous alert prioritization problem rather than a binary decision problem (i.e., whether an alerting threshold is exceeded), allowing us to evaluate performance across all possible thresholds and thus model SOCs of varying sizes and alert volumes. We distill five fundamental risk hypotheses, formalize them as independently parametrizable modules, and implement them in our novel experimentation suite CATS. We thoroughly assess the hypotheses across eight diverse alert datasets, six of which we created or extended to make such an evaluation possible. Our results show that certain combinations of hypotheses achieve a remarkable alert prioritization performance (AUROC $\mu=0.92$, $\sigma=0.09$ across the eight datasets), outperforming a straightforward prioritization by alert severity level (AUROC $\mu=0.72$, $\sigma=0.21$). We conclude that RBA can substantially reduce the number of false alerts that analysts have to review and thus has the potential to mitigate cybersecurity alert fatigue. In addition, it serves as a strong baseline for more complex, resource-intensive alert triage approaches (e.g., based on large language models).