That Escalated Quickly: An ML Framework for Alert Prioritization

TL;DR

This paper introduces TEQ, a machine learning framework designed to reduce alert fatigue in Security Operations Centers by accurately predicting alert actionability, thereby improving response efficiency and false positive suppression.

Contribution

The paper presents a novel ML framework, TEQ, that effectively prioritizes alerts in SOCs with minimal workflow disruption, achieving significant reductions in response time and false positives.

Findings

22.9% reduction in incident response time

54% false positive suppression with 95.1% detection rate

14% decrease in alerts per incident investigated

Abstract

In place of in-house solutions, organizations are increasingly moving towards managed services for cyber defense. Security Operations Centers are specialized cybersecurity units responsible for the defense of an organization, but the large-scale centralization of threat detection is causing SOCs to endure an overwhelming amount of false positive alerts -- a phenomenon known as alert fatigue. Large collections of imprecise sensors, an inability to adapt to known false positives, evolution of the threat landscape, and inefficient use of analyst time all contribute to the alert fatigue problem. To combat these issues, we present That Escalated Quickly (TEQ), a machine learning framework that reduces alert fatigue with minimal changes to SOC workflows by predicting alert-level and incident-level actionability. On real-world data, the system is able to reduce the time it takes to respond to actionable incidents by $22.9\%$, suppress $54\%$ of false positives with a $95.1\%$ detection rate, and reduce the number of alerts an analyst needs to investigate within singular incidents by $14\%$.