Enhancing False Positive Alert Detection in Security Information and Event Management System Using Recurrent Neural Network
Mst. Nishita Aktar, Md. Nazmus Sakib, Afzal Hossain, Ahsan Ullah, Kazi Hassan Robin, Kh. Mustafizur Rahman, Md Tuhin Reza, Ali Ameen, Md. Murad Hossain, Debashis Kundu · 2024
An empirical analysis is conducted to reduce the false positive alerts in Security Information and Event Management (SIEM) systems. Through the use of recurrent Neural Networks (RNN), research aims to increase alert detection accuracy and reduce false positive rates. In order to reduce false positives in SIEM systems, this study applies a novel combination of well-established techniques, such as Random Forest classifiers, Echo State Networks (ESN), and Term Frequency-Inverse Document Frequency (TF-IDF) for feature extraction. Although a lot of research has been done on these approaches in other fields, they haven’t been tested in the context of SIEM systems using the particular dataset that this study employed, which came from Kaggle. Investigation demonstrates that the ESN-Random Forest combo yields superior outcomes, achieving high precision, a 99.5% detection accuracy, and a considerable decrease in false positive rates.Study limits in introducing the primary dataset, which is forced to depend only on publicly available dataset.This may not adequately portray the nuances and complexity of real Security Information and Event Management (SIEM) systems.