# Breaking Alert Fatigue: AI-Assisted SIEM Framework for Effective Incident Response
## 4 Methodology
### Filtering Problem
#### 4.1.1 Filtering by Cost-Sensitive Learning  
In this context, the filtering problem can be addressed by utilizing the classifier algorithms discussed in the previous section. However, the classification problem defined by the filtering problem is frequently associated with two main challenges. First, there is an extremely imbalanced distribution of positive and negative classes, which can make it difficult for the classifier to learn from the data effectively. Second, the impact of classification errors varies, with false positives and false negatives having different levels of harm to the system. Here, false positives refer to noncritical alerts that are misclassified as critical, and false negatives refer to critical alerts that are missed or classified as noncritical. This means that it is crucial to use an approach that considers the asymmetric costs of misclassification and the severe class imbalance present in the filtering problem. A promising technique that can address these challenges is cost-sensitive learning [66], which assigns different costs to false positives and false negatives based on their impact on the system, and it can optimize the overall cost of misclassification. This is consistent with the requirement for setting a higher weight for the minority class, commonly critical alerts, to improve the prediction accuracy for such samples. Cost-sensitive learning [66] can help encode prior knowledge about the class importance and sample instance importance differently in the classifier. In this study, we adopt the SVM classifier. Assigning a high weight to a class suggests that the learning algorithm should attempt to classify samples from that class correctly, possibly at the expense of misclassifying samples from the other class. This heuristic can be applied successfully to critical alerts because they require higher detection accuracy than noncritical alerts. This weight factor should be considered as class weights. However, information, e.g., source and destination IP addresses, timestamps, file names, and file hashes, that does not generalize well for classification is removed from the alerts during the processing; thus, the one-hot encoding yields many identical numerical vectors with very similar alerts corresponding to the same attack detected in different occasions. Training a classifier with many replicated samples is inefficient, and this can be addressed by assigning weights that reflect the frequency of the alerts to the samples. Note that this weight factor is deemed an instance weight. To differentiate it from the WSVM [61], we refer to this SVM classifier, which considers class weight and instance weight simultaneously, as the IWSVM. To adopt the proposed IWSVM in the learning process, we first group the numerical vectors to obtain a set of unique vectors and their instance weights following the definition given below. **Definition 2** (**Instance Weight**). : _In the context of alert databases, we define the instance weight of a vector \(\mathbf{u}_{i}\) as follows. Let \(h:S\rightarrow\mathbb{N}\) be a function that maps each vector to its frequency in the database and let \(C\) be a set of categories. Let \(w:C\rightarrow\mathbb{R}\) be a function that assigns a weight to each category to indicate its importance. Define \(g:S\to C\) as a function such that \(g(\mathbf{u}_{i})=c_{j}\) if and only if \(\mathbf{u}_{i}\) belongs to category \(c_{j}\). Then, the instance weight \(W(\mathbf{u}_{i})\) for \(\mathbf{u}_{i}\) is given by \(W(\mathbf{u}_{i})=h(\mathbf{u}_{i})w(g(\mathbf{u}_{i}))\)._  
The instance weight of a sample vector is determined by the frequency of the corresponding alert in the database and the class weight, which is a predefined empirical value indicating the importance of the class.