Reduction of Alert Fatigue using Extended Isolation Forest

Alerts are tasks that continually monitor active queries to look for and report on specific events or conditions like system performance, security incidents, and threats for a system or network. Companies with an extensive IT infrastructure often deal with many alerts per day, varying from a routine host or network performance notifications to security incidents raised by Network Security Devices. With an increase in cyberattacks, Network Security Devices play a vital role in detecting critical incidents and threats. However, more often than not, these security incidents are frequently occurring low threat alerts. As the number of alerts skyrockets, it becomes increasingly tedious to sift through all the alerts generated and identify critical one. This may result in longer response time or overlooking important alerts, which is referred to as alert fatigue. Aiming to tackle this problem, our paper proposes a solution to reduce alert fatigue by identifying and highlighting anomalous alerts using Extended Isolation Forest, an isolation-based anomaly detection technique. Our model reduces the number of alerts received at the Security Operations Center (SOC) by 82.15%. The security analyst needs to monitor only 17.85% of the 50,000 total alerts received from the IDS.