RAPID: Real-Time Alert Investigation with Context-aware Prioritization for Efficient Threat Discovery
Yushan Liu, Xiaokui Shu, Yixin Sun, Jiyong Jang, Prateek Mittal · 2022
Alerts reported by intrusion detection systems (IDSes) are often the starting points for attack campaign discovery and response procedures. However, the sheer number of alerts compared to the number of real attacks, along with the complexity of alert investigations, poses a challenge to achieving effective alert triage with limited computational resources. Automated procedures and human analysts could suffer from the burden of analyzing floods of alerts, and fail to respond to critical alerts promptly.