Enhancing Incident Response with Machine Learning Models
Open Access DepositedAutomating and Augmenting Threat Analysis
This praxis discussed the challenges faced by the security operations centers when encountering a high volume of alerts, making it difficult for the analysts to triage alerts efficiently. The praxis proposes a hybrid ensemble solution that combines distinct models such as supervised, unsupervised, and reinforcement learning that can enhance the incident response workflow. With these solutions, analysts can be confident that the models are optimized for precision to capture alerts including signature-based and anomaly-based alerts. The models proposed in this praxis are trained on the GUIDE dataset provided by Microsoft through Kaggle as it serves as a primary source for training and evaluation of the models. Additionally, the study trains and tests the models on a UNSW-NB15 dataset to ensure the model continues to perform on different datasets as well. To further ensure that analysts are presented with enough information to make the decision confidently, the study incorporates explainable AI techniques (XAI) using SHAP for transparency and GPT4o-mini to generate incident summaries and offer explanations for the decision making by the model and provide handling guidance to the analysts. The results of the experiments demonstrate that the hybrid ensemble model outperformed the individual baseline models in detecting accuracy and precision. The models are evaluated using the macro F1-score as the incident datasets can be highly imbalanced. The hybrid ensemble outperformed the single baseline model. The XAI component further clarified the results by elaborating on the model decision making a vi readable format using XAI and LLM on both datasets on which the methodology was tested.
- All rights reserved
Notice to Authors
If you are the author of this work and you have any questions about the information on this page, please use the Contact form to get in touch with us.