Reducing Information Overload: Because Even Security Experts Need to Blink
Philipp Kuehn, Markus Bayer, Tobias Frey, Moritz Kerk, Christian, Reuter

TL;DR
This paper evaluates various clustering methods and embedding models to automate and significantly reduce the information overload faced by CERT analysts, improving efficiency while maintaining data integrity.
Contribution
It systematically assesses 196 clustering and embedding combinations to identify effective, minimal-configuration solutions for consolidating security information.
Findings
Clustering reduces information processing by over 90%.
Deep clustering achieves high semantic homogeneity.
Potential to save over 3.75 work hours annually per analyst.
Abstract
Computer Emergency Response Teams (CERTs) face increasing challenges processing the growing volume of security-related information. Daily manual analysis of threat reports, security advisories, and vulnerability announcements leads to information overload, contributing to burnout and attrition among security professionals. This work evaluates 196 combinations of clustering algorithms and embedding models across five security-related datasets to identify optimal approaches for automated information consolidation. We demonstrate that clustering can reduce information processing requirements by over 90% while maintaining semantic coherence, with deep clustering achieving homogeneity of 0.88 for security bug report (SBR) and partition-based clustering reaching 0.51 for advisory data. Our solution requires minimal configuration, preserves all data points, and processes new information within…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsNetwork Security and Intrusion Detection · Information and Cyber Security · Complex Network Analysis Techniques
