# AI-Assisted Security Alert Data Analysis with Imbalanced Learning Methods
## 3 Methodology
### Resampling
#### 3.4.3 Ensemble Resampling  
Figure 2c shows the training data generation process using ensemble resampling. First, each oversampling method generated a subset of synthetic positive samples. Second, the generated subsets were merged to form the MAS. Third, a data subsampling method was employed to obtain clean negative alert samples. Finally, the training data were obtained by combining the MAS and cleaned negative samples. MAS and data subsampling methods are described in detail below:  
* Merged Augmented Set: We selected and implemented an ensemble of three of the most-effective data augmentation algorithms to generate synthetic security alert data: SMOTE, ADASYN, and SVMSMOTE. The ensemble resampling technique was used to generate an MAS of variational synthetic positive samples with high quality to mitigate the weaknesses arising from using a high oversampling rate, resulting in an improved FPR. The advantage of using an MAS includes a reduced sampling rate for each oversampling technique with less possibility of ill-formed synthetic samples and a more realistic distribution mimicking real data, as density-based methods are engaged.
* Subsampling Negative Security Alerts: Data subsampling methods select data samples to retain or delete [57; 60]. We found that approaches that combine deletion and retention work best for subsampling security alert data. We compared the performance of two data subsampling methods for data deletion and retention: one-sided selection (OSS) [6; 61] and the neighborhood cleaning rule (NCR) [62]. These two algorithms were used to identify and remove ambiguous, noisy, and redundant security alert samples from the negative class.
* The OSS algorithm combines the condensed nearest neighbor algorithm [63] and the Tomek links [64]. The condensed nearest neighbor algorithm is an undersampling algorithm that identifies a minimal consistent set and removes redundant and ambiguous negative samples. Tomek links remove noisy and borderline negative samples. Data processing was performed as follows: First, using the condensed nearest neighbor, all positive samples and one randomly selected negative sample were added to a store. Second, the NN rule was used to classify training samples using the alerts in the store and to compare the assigned labels with the original ones. All misclassified samples were moved into the store, which is consistent with the training samples, while being smaller. Finally, all the negative samples participating in Tomek links were removed from the store to  
\begin{table}
\begin{tabular}{c c l} \hline \hline
**Parameters** & **Algorithms** & **Definition** \\ \hline _sampling\_strategy_ & SMOTE; ADASYN; & Sampling rate used to oversampling the dataset \\ _k\_neighbors_ & SMOTE; SVMSMOTE & Number of NNs used to generate synthetic samples \\ _n\_neighbors_ & ADASYN & Number of NNs used to generate synthetic samples \\ _threshold\_cleaning_ & NCR & Determine condensed nearest \\  & & neighbor application \\ _ss\_n\_neighbors_ & OSS; NCR & Neighborhood size for a sample and its NNs \\ \hline \hline \end{tabular}
\end{table}
Table 1: Oversampling and undersampling parameters.  
remove borderline and noisy negative samples. All the positive samples were retained, and the resultant set was a set of clean samples.
* The NCR algorithm combines the condensed nearest neighbor and edited nearest neighbor (ENN) algorithms [65]. ENN is an undersampling algorithm that uses \(k\) NNs to identify and remove misclassified or noisy negative samples before applying the \(k\)-NN classification algorithm. First, the algorithm selects all the positive samples. All noisy samples in the negative class are then identified and removed using the ENN rule. Finally, a one-step condensed nearest neighbor removes the remaining negative samples that are misclassified against the store, but only if the number of negative samples is larger than half the size of the positive class.  
The crucial parameters of the OSS and NCR algorithms are listed in Table 1.