# Breaking Alert Fatigue: AI-Assisted SIEM Framework for Effective Incident Response
## 1 Introduction
Unfortunately, the effectiveness of contemporary SIEMs is frequently hindered by various challenges that make them as much of a burden as a benefit. In addition, many advanced qualities, including enhanced visualization, open-source intelligence, and artificial intelligence (AI)/machine learning (ML) capabilities, are attractive features for next-generation SIEMs [15]. Thus, in this paper, by leveraging the latest AI, ML, and visualization technologies, we propose a framework for a next-generation SIEM system that integrates genuine security orchestration automation and response (SOAR) capabilities to realize effective incident detection and response. We address the key issue of alert fatigue caused by high numbers of low-quality IDS alerts using a divide-and-conquer strategy. First, we decompose alert fatigue into two causal sub-problems, i.e., filtering and correlation problems [16]. Second, we employ advanced AI and data visualization methods to solve each sub-problem. Specifically, we model the filtering problem as a supervised learning task to screen out false alerts in the IDS output using an instance-weighted support vector machine (IWSVM), which is a cost-sensitive learning method. The correlation problem is addressed by grouping correlated alerts into events using a procedure that exploits their homogeneity and temporal coincidence. We then introduce a novel visualization tool to confirm the results of this grouping procedure. The proposed solution provides an alternative perspective on the alert fatigue problem, which is commonly recognized as a key issue in enterprise SOC operations. By synergistically exploiting advanced AI/ML and data visualization tools, we provide an integrated solution and prototype for a next-generation SIEM. Our primary contributions are summarized as follows. * We propose a comprehensive framework to design and implement a next-generation SIEM system, and we demonstrate its effectiveness by prototyping the key components of the framework. * We formalize a divide-and-conquer strategy to mitigate the alert fatigue problem and introduce practical solutions for each of its component problems, i.e., the filtering and correlation problems. We also present practical solutions to these problems, including the use of the cost-sensitive IWSVM learning method to address the issue of imbalanced learning in the filtering process and an algorithm that leverages the proximity, spatial, and temporal homogeneity of alerts to effectively summarize them into events for more efficient incident handling. * We present an augmented visualization tool, which we refer to as augmented tile graph (ATG), and demonstrate its ability to improve the performance of data analysis against security alerts. Overall, this paper offers a valuable contribution toward the development of a next-generation SIEM system that effectively addresses the challenge of alert fatigue and paves the way for future research in this field. The remainder of this paper is organized as follows. Section 2 provides the necessary background for efficient incident handling in an SOC and reviews related work on alert fatigue. Section 3 introduces the proposed system framework, and Section 4 discusses the design and implementation of the component systems to address alert fatigue. Section 5 presents experimental results that demonstrate the effectiveness of the proposed approach on real enterprise network data. Section 6 discusses the limitations of the proposed framework and identifies potential directions for further improvement. Finally, the paper is concluded in Section 7.