RAPID: Real-Time Alert Investigation with Context-aware Prioritization for Efficient Threat Discovery
Yushan Liu, Xiaokui Shu, Yixin Sun, Jiyong Jang, Prateek Mittal
Abstract
Alerts reported by intrusion detection systems (IDSes) are often the starting points for attack campaign discovery and response procedures. However, the sheer number of alerts compared to the number of real attacks, along with the complexity of alert investigations, poses a challenge to achieving effective alert triage with limited computational resources. Automated procedures and human analysts could suffer from the burden of analyzing floods of alerts, and fail to respond to critical alerts promptly.
Topics & Concepts
Computer sciencePrioritizationIntrusion detection systemTriageContext (archaeology)Computer securityData scienceMedical emergencyEngineeringMedicineProcess managementPaleontologyBiologyNetwork Security and Intrusion DetectionInformation and Cyber SecurityAdvanced Malware Detection Techniques