DeepARR: Alert risk rating based on deep learning

Alert fatigue has caused serious consequences for enterprise security. When analysts are inundated with a vast number of alerts, high-risk alerts may be overlooked or responded to with delay, thereby exposing the organization to potential cyber threats or data breaches. Although there are many alert classification research focusing on reducing alerts, it’s still impossible to investigate all alerts due to the resource shortage. Therefore, it is necessary to prioritize alerts based on their potential severity, allowing analysts to address higher-risk alerts first. This paper proposes a novel alert risk rating DeepARR (Deep Learning-based Alert Risk Rating), that utilizes deep learning technology to rate alert risk levels in bulk instead of investigating each alert individually. It first employs a dynamic time window segmentation approach to merge alerts, reducing the overall number. Subsequently, a directed graph-based method is proposed to handle data imbalance. Both temporal-spatial features and event features are extracted. Finally, deep learning techniques are used to classify alert levels. The proposed method is evaluated on the public CPTC-2018 alert dataset. Compared with existing methods, DeepARR achieves an average precision of 95.73%, a recall of 94.83%, and an F1 Score of 94.84% in risk rating, demonstrating its higher effectiveness.