HyperLAC: Hypergraph-based Large-scale Alert Classification with spatial-temporal context enhancement

Alert fatigue is a persistent problem in security operation centers. Machine learning (ML)-based algorithms are widely adopted to help dispose alerts automatically. However, security analysts find it difficult to comprehend security events owing to the complicated relationship between alerts. Moreover, the performance of ML-based algorithms heavily relies on large amounts of labeled data, which are hard to obtain in a real network environment. Herein, we propose HyperLAC, a hypergraph-based large-scale alert classification method, to dispose massive alerts using context-enhanced features. We represent the nonlinear and multivariate relationships between alerts by constructing an alert hypergraph based on the alerts’ attribute correlation. Subsequently, we propose an adaptive incremental hypergraph clustering algorithm to efficiently extract potential security events from alert clusters. By enhancing the features of each alert using its spatial-temporal contextual features obtained from security events, we can train an effective alert classifier based on few lightweight, conventional classifiers. Results from public and real datasets show that HyperLAC can classify massive alerts accurately and cost-effectively.