# AI-Assisted Security Alert Data Analysis with Imbalanced Learning Methods
## 3 Methodology
### Classification and Analysis  
This section covers the algorithms used to classify security alert data into positive and negative classes. We selected five classification algorithms that can efficiently handle high-dimensional sparse data: logistic regression (LR), \(k\)-NN, decision trees (DTs) [66; 67], extreme gradient boosting (XGBoost) [68], and light gradient boosting machine (LightGBM) [69]. We used these algorithms to build prediction models for security alert data and subsequently evaluated them using stratified \(k\)-fold cross-validation. LR models calculate the probability of a discrete outcome given an input variable. This is a robust and flexible method for predicting binary outcomes or states, making it a valuable analytical tool for classification problems. LR is particularly useful for alert analysis, because it can determine whether a new sample fits best into a given class. The algorithm predicts the probability that \(y\) is associated with input variable \(X\) using the logistic function Equation (1). \[P(X)=\frac{e^{\beta_{0}+\beta_{1}X}}{1+e^{\beta_{0}+\beta_{1}X}} \tag{1}\]  
where \(\beta_{0}\) is the bias or intercept term and \(\beta_{1}\) is the coefficient for the single input value (\(x_{i}\)). \(k\)-NN is a simple, easy-to-implement supervised ML algorithm. It is assumed that similar samples exist in close proximity to each other. In a classification task, the algorithm determines the distance between a query sample and all samples in the data and selects the specified number of \(k\) NNs, and subsequently, the NNs define the label of the query sample by a majority vote. \(k\)-NN classifiers have a fixed user-defined constant for the number of neighbors that must be determined. Neighbors-based methods are known as non-generalizing ML methods because they store all the training data. \(k\)-NN uses the Euclidean distance method to compute the closest neighbors to a given data point, as shown in Equation (2). \[d(x,y)=\sqrt{\sum_{i=1}^{n}(x_{i}-y_{i})^{2}} \tag{2}\]  
DTs are supervised ML algorithms that can predict the data class by learning simple decision rules inferred from training data. It has a hierarchical tree structure consisting of root nodes, branches, internal nodes, and leaf nodes. A DT starts with a root node that does not have incoming branches. The outgoing branches from the root node feed into the internal nodes, also known as decision nodes. Based on the available features, both node types conduct evaluations to form homogenous subsets denoted by leaf or terminal nodes. The leaf nodes represent all possible outcomes within the dataset. DT learning employs a divide-and-conquer strategy by conducting a greedy search to identify optimal split points within a tree. This process of splitting is repeated in a top-down recursive manner until all or the majority of the samples have been classified under specific class labels. Information gain and Gini impurity are popular splitting criteria for decision-treemodels. These methods are used to select the best attribute at each node and help evaluate the quality of each test condition and determine its ability to classify samples into a class. The Gini index measures the total variance across \(N\) classes and is defined by Equation (3), where \(pmk\) represents the proportion of training variables in the \(m\)th segment that belong to the \(k\)th class. \[G=-\sum_{k=1}^{k}P_{mk}(1-P_{mk}) \tag{3}\]  
LightGBM is a distributed high-performance gradient boosting framework that uses tree-based learning algorithms for classification tasks. The algorithm creates DTs that grow leafwise, i.e., given a condition, only a single leaf is split, depending on the gain, and the leaf with the maximum delta loss is chosen to grow. This is in contrast to other boosting algorithms that grow tree-levelwise. LightGBM improves the gradient-boosting algorithm by adding automatic feature selection and focusing on boosting examples with significant gradients.