# Breaking Alert Fatigue: AI-Assisted SIEM Framework for Effective Incident Response
## 4 Methodology
### Correlation Problem
#### 4.2.1 Implementing Alert Correlation
However, at least one of the source or destination ports may have multiple values. To determine the service port, we utilize the heuristic that, as the target of a series of similar attacks, it should appear in the alerts more frequently than randomly selected attacking ports. By comparing the information entropy of the source and destination ports, we can determine the service port as the one with lower entropy (with relatively high confidence). If the comparison does not yield a clear advantage, we utilize a combination of the source and destination ports as the service port identifier to merge alerts into events. An implementation of the event segmenting algorithm is presented in Algorithm 1. The function takes a set of events, including source ports, destination ports, and issuing timestamps (\(s_{i}\), \(d_{i}\), and \(t_{i}\)), as well as a timeout parameter (\(\tau\)) and threshold parameter (\(\beta\)). First, the algorithm calculates the number of unique source and destination ports, and then it divides the alerts into multiple events if there are several unique source and/or destination ports. Here, it utilizes entropy to measure the level of uncertainty along different ports. A higher entropy value indicates greater uncertainty in the specific port. The algorithm splits the events based on the port with lower entropy. The \"SplitByTimeout\" function then further segments events with the same service port. This function is straightforward to implement based on the temporal condition in Equation (4). Specific implementation details are omitted here for brevity. The \(\beta\) parameter controls the degree of bias toward one port, and in our experiment, this was set to 0.58. **Definition 4** (Entropy [69]). : _Let \(Z\) be a random variable representing a set of source or destination ports observed in IDS alerts, with individual observations denoted \(z_{i}\). Typically, \(z_{i}\) takes on integer values in the range 0-65,535. In addition, assume that \(Z\) is distributed according to a probability distribution \(p:\mathcal{Z}\rightarrow[0,1]\). Thus, the entropy of \(Z\) can be obtained as follows:_  
\[H(Z)=-\sum_{z}p(z)\log p(z). \tag{5}\]  
The value of the timeout parameter (\(\tau\)) used to define an event associated with an attack campaign may vary depending on several factors, including the specific use case, the network being monitored, the types of detected attacks, and the alert-issuing IDS settings. Typically, this parameter is used to set a maximum time interval for grouping a series of related alerts or activities as part of the same attack campaign. In common IDSs,timeout values for reissuing alerts can range from several seconds to several minutes (or even longer in some cases). When using the timeout parameter to group closely related alerts that satisfy the three-tuple condition, it is more suitable to set a larger value to avoid the negative impact of repetitive escalation candidates, as found in our experiment. For example, we found that a timeout value of 7200 s was suitable to group hourly recurring, identical alerts into a single event and notifying the operator about alerts of the same type only if there is a gap of at least two hours between alerts. ```
0\(\leq t_{i+1}-t_{i}\leq\tau\) for \(i=2,\ldots,N-1\)
1:functionSegmenting(\(\{[s_{i},d_{i},t_{i}]\}\), \(\tau\), \(\beta\))
2:\(n_{\text{s}}\leftarrow\text{CountUnique}(\{s_{i}\})\)
3:\(n_{\text{d}}\leftarrow\text{CountUnique}(\{d_{i}\})\)
4:if\(n_{\text{s}}=1\)or\(n_{\text{d}}=1\)then\(\triangleright\)\(1\times\) multi or multi \(\times\)1
5:\(E\leftarrow\{[s_{i},d_{i},t_{i}]\}\)\(\triangleright\) multi \(\times\) multi
6:else\(\triangleright\) multi \(\times\) multi
7:\(e_{\text{s}}\leftarrow\text{Entropy}(\{s_{i}\})\)
8:\(e_{\text{d}}\leftarrow\text{Entropy}(\{d_{i}\})\)
9:if\(e_{\text{s}}/e_{\text{d}}<\beta\)then\(\triangleright\) source as service
10:\(E\leftarrow\text{SplitByTimeout}(\{s_{i}\},\{t_{i}\},\tau)\)\(\triangleright\) dest. as service
11:elseif\(e_{\text{d}}/e_{\text{s}}<\beta\)then\(\triangleright\) dest.