# Breaking Alert Fatigue: AI-Assisted SIEM Framework for Effective Incident Response
## 3 Proposed SIEM Framework
### Machine Learning Module
#### 3.3.3 Baseline Classification Methods  
As baseline methods for comparison, we evaluated six classification methods that can efficiently handle high-dimensional sparse data [62]: \(K\) nearest neighbors (KNN), naive Bayes (NB), linear discriminant analysis (LDA), decision tree (DT), AdaBoost, and SVM. These methods were used to create prediction models for the alert dataset (Section 5). The proposed IWSVM and the reference WSVM are described in Section 4.  
KNN is a well-known machine learning algorithm used for classification and regression tasks. It finds the \(K\) closest training samples in the feature space and assigns the class of the test sample based on majority vote of these neighbors. It is simple and effective but sensitive to irrelevant features and computationally expensive for large datasets or high-dimensional feature spaces.  
NB is a probabilistic machine learning algorithm used for classification tasks. It works by computing the probability of a test sample belonging to each class based on the probabilities of the features given to each class and then assigning the class with the highest probability. It assumes independence between features, making it efficient for high-dimensional datasets. It is simple and fast, but the independence assumption may not hold in some cases.  
LDA is a supervised machine learning algorithm used for classification tasks. It works by projecting the data onto a lower-dimensional space while maximizing the separation between the classes. It assumes normality and equal covariance matrices but may not work well if these assumptions do not hold.  
DT is a supervised machine learning algorithm used for classification and regression tasks. It works by recursively splitting the data into subsets based on the values of features, with the goal of maximizing the purity of each subset. It is simple and easy to interpret, but can be prone to overfitting and may not generalize well. Techniques such as pruning and ensemble methods can help address these issues.  
AdaBoost is a supervised machine learning algorithm used for classification tasks. It works by combining several weak classifiers into a strong one by iteratively training them on weighted versions of the data and giving higher weights to misclassified samples. It is powerful and less prone to overfitting but can be sensitive to noisy data and outliers.  
SVM is a supervised machine learning algorithm used for classification and regression tasks. It works by finding the hyperplane that separates the data into classes with the largest margin possible. The hyperplane is chosen to maximize the distance between the closest samples of each class, which are called support vectors. SVM is powerful and less prone to overfitting but can be computationally expensive and sensitive to the choice of kernel function and regularization parameters. We chose to use the Radio Basis Function (RBF) kernel-based SVM in the experiment because it is good at dealing with complex, non-linear datasets and has a feature that prevents overfitting.