# Breaking Alert Fatigue: AI-Assisted SIEM Framework for Effective Incident Response
## 4 Methodology
### Augmented Tile Graph Visualization  
In this section, we reintroduce the tile graph method [61] as a way to visualize massive and interconnected alerts. The tile graph divides the plot area into two sub-panels, namely the source panel on the left and the destination panel on the right (Figure 2(a)). The \(x\)-axis of the source panel represents the timestamp of the triggered alert, while the \(y\)-axis indicates the source IP addresses involved in the communication. In contrast, the \(x\)-axis and \(y\)-axis of the destination panel represent the destination IP addresses and destination ports involved in the communication, respectively. To ensure the distinguishability of IP addresses, they are uniformly positioned on the axes based on their occurrence order. A line is drawn between a source IP address and a destination IP address to represent each alert. The color of the line reflects the status of the source and destination IP addresses, as indicated in Figure 2(b). For instance, a blue line represents an alert triggered by an internal host communicating with an external host on the Internet. Figure 2(a) shows an ATG illustrating the \"HTTP login brute-force detected\" attack over a one-week period. The ATG reveals that a considerable number of alerts were triggered by communications between internal hosts and the proxy server, as highlighted by the blue lines toward the proxy server enclosed by ellipse A. Although such erroneous communications may not be significant to a security operator, the operator may wish to concentrate on the more distinct attack attempts that display a periodic nature, as highlighted by ellipses B and C. The ATGs provide a valuable perspective of the complexity of cyberattack campaigns, which can help security operators reduce the costs associated with log parsing; thus, they can focus their attention on more critical incidents. The ATG is a powerful framework for visualizing complex datasets, particularly those containing source and destination information found in alert messages. By encoding this information into a set of coordinate variables, the ATG creates an intuitive visualization that facilitates pattern discovery. This approach can visualize various data types, as demonstrated in the context of visualizing the results of the proposed event segmenting algorithm. In this case, alerts occurring between two fixed IP addresses are visualized, thereby freeing up axes previously used to display IP addresses to encode other relevant information. In the examples shown in Figure 4, the source plane uses the \(x\)-axis to represent time and the \(y\)-axis to represent source ports, and the destination plane uses the \(x\)-axis to represent attack types and the \(y\)-axis to represent destination ports. The color of the connecting line in the ATG represents the event label assigned by the algorithm. Here, related events are assigned the same color, which makes it easier to identify event clusters and draw conclusions regarding network behavior. Figure 4a shows the effectiveness of the event segmenting algorithm. Here, ellipse A contains a group of alerts notifying attacks against port 22, detected as the same type of attack but divided into different events due to exceeding the timeout threshold. Ellipse B contains attacks targeting the same port with varying source ports in a short period, thereby satisfying the conditions of the proximal, spatial, and temporal compactness; thus, these attacks can be merged into a single event. In Figure 4b, ellipse C shows alerts notifying attacks against the same target port that were detected as different types of attacks. These attacks are divided into two events due to a relatively strict proximal criterion, and the same situation is observed with the alerts in ellipse D, indicating that the imposed proximal criterion may be too strong. Thus, there is room to implement a milder criterion to reduce the number of escalation candidates. Figure 3: Visualization of “HTTP login brute-force detected” attacks using the tile graph.