Ranking Network Devices for Alarm Prioritisation: Intrusion Detection Case Study

Some devices in a network are more important than others, and potential issues with an important network device could cause significantly more damage than issues with less important devices. This paper proposes a method that can rank various device reports by using a learning-to-rank algorithm to help the end-user detect higher priority alarms easier. A pairwise learning-to-rank algorithm is used to incrementally train a model with a custom dataset while testing its accuracy on a separate testing set. Predicting the ranking for the first two, five, and all ten items in a testing dataset showed an upward trend of model accuracy. Using this method we were able to achieve a ranking accuracy surpassing 95%. The proposed method is discussed on an Intrusion Detection System case study.