Deep learning for prioritizing and responding to intrusion detection alerts

Network intrusion detection systems are widely deployed to detect cyberattacks against computer networks. These systems generate large numbers of security alerts that require manual review by security analysts to determine the appropriate courses of action required. The review of these security alerts is time consuming and can cause fatigue for security analysts, especially during long work shifts. This paper reviews a case study of the application of machine learning to the initial triage of security alerts to help reduce the manual burden placed on Department of Defense (DOD) cyber defense security analysts. This study implemented a Federated Analysis Security Triage Tool prototype. The FASTT prototype attempted to highlight, summarize and categorize tens of thousands of daily alerts/events. The prototype integrated a number of tools including TensorFlow deep neural network classifier, Elasticsearch and Kibana to provide an alternative approach for cyber defense analysts. FASTT provides a quick way to perform security alert reviews, speed up analyst queries/response, and to semi-automate threat intelligence reporting. The results of this study were evaluated for accuracy and usability. Results demonstrated that the accuracy of a deep neural network classifier was very high, as it was able to determine the heuristics that the cyber defense security analysts used in their review. Demonstrations and interviews with the security analysts showed that the prototype was able to quickly categorize security alerts into meaningful categories, provide fast query of the alerts, and save time in generating reports. Lastly, FASTT was able to pull the necessary information to generate Indications of Compromise (IOC) in a STIX/TAXII format that could be shared across DOD and US Government.