# AI-Assisted Security Alert Data Analysis with Imbalanced Learning Methods
## 5 Conclusions  
This study proposed a bidirectional approach to cope with excessive skewness in security alert data analysis scenarios. The proposed approach implemented an ensemble of carefully selected oversampling methods to generate the MAS of variational synthetic positive alert samples with high quality. In addition, a data subsampling algorithm was employed to identify and remove ambiguous, noisy, and redundant negative alert samples. The results obtained using an enterprise and the UNSW-NB15 benchmark datasets demonstrate that classification models obtained using MAS-OSS can simultaneously yield improved recall and FPR, with the proposed system, XGBoost-MAS-OSS, achieving superior performance on all evaluation metrics. Notably, the high recall rate of the system indicates its effectiveness in detecting positive alerts. Moreover, the improved FPR suggests that the number of non-critical security alerts investigated by security analysts in the SOC has been reduced, thus addressing the alert fatigue issue, which has been a persistent challenge in the security industry for several years. This study focuses on data resampling methods to address the class imbalance problem in security alert data analysis. In future works, other methods for imbalanced security alert data classification, such as cost-sensitive kernel modification, active learning, and hybrid approaches, can be explored to enhance the performance of the proposed system. In addition, recently, research on intrusion analysis has used deep learning techniques such as CNN and DNN, where feature extraction approaches such as auto-encoders and deep stacked auto-encoders are used for data structure improvement and model complexity reduction. These approaches should be investigated in future studies. \begin{table}
\begin{tabular}{l c c c c c c c} \hline \hline
**Algorithms** & \
\begin{tabular}{c} **Accuracy** \\ **(\%)** \\ \end{tabular} & **Recall (\%)** &
\begin{tabular}{c} **Precision** \\ **(\%)** \\ \end{tabular} & **FPR (\%)** & **TNR (\%)** & **F-Score (\%)** & **BCR (\%)** \\ \hline IF [39] & 90.705 & 100.000 & 0.551 & 9.300 & 90.700 & 1.097 & 95.350 \\ IF-DC [40] & 94.141 & 95.876 & 0.837 & 5.860 & 94.140 & 1.659 & 95.008 \\ DT-SVMSMOTE [13] & 99.596 & **99.524** & 79.771 & 0.403 & 99.597 & 88.559 & 99.560 \\ CNN-MAS-OSS & 83.685 & 73.558 & 6.798 & 16.153 & 83.847 & 12.447 & 78.703 \\ LSTM-MAS-OSS & 99.185 & 95.433 & 66.948 & 0.755 & 99.245 & 78.692 & 97.339 \\ XGBoost-MAS-OSS & **99.875** & 99.519 & **93.034** & **0.119** & **99.881** & **96.167** & **99.700** \\ \hline \hline \end{tabular}  
* IF, IF-DC, DT-SVMSMOTE, CNN-MAS-OSS, LSTM-MAS-OSS and XGBoost-MAS-OSS stand for isolation forest, IF with day-forward chaining, decision tree with support vector machine synthetic minority oversampling technique, convolutional neural network with merged augmented set and one-sided selection, long short-term memory with MAS-OSS, and extreme gradient boosting with MAS-OSS.  
\end{table} 
Table 6: Performance comparison with related work on the enterprise dataset. \begin{table}
\begin{tabular}{l c c c c} \hline \hline
**Algorithms** & **Accuracy (\%)** & **Recall (\%)** & **Precision (\%)** & **F-Score (\%)** \\ \hline DNN [49] & 78.400 & 72.500 & 94.400 & 82.000 \\ Few-shot learning [50] & 92.000 & – & – & 92.110 \\ Stacked autoencoder-softmax [51] & 89.134 & 63.270 & 89.134 & 90.850 \\ Autoencoder-CNN [47] & 93.400 & – & – & 95.290 \\ LSTM-MAS-OSS & 86.967 & 59.770 & 39.714 & 47.720 \\ CNN-MAS-OSS & 91.187 & 78.772 & 53.917 & 64.017 \\ XGBoost-MAS-OSS & **99.469** & **96.772** & **97.873** & **97.319** \\ \hline \hline \end{tabular}  
* DNN, CNN, LSTM-MAS-OSS, CNN-MAS-OSS, and XGBoost-MAS-OSS stand for deep neural networks, convolutional neural networks, long short-term memory with merged augmented set and one-sided selection, CNN with MAS-OSS, and XGBoost with MAS-OSS.  
\end{table} 
Table 7: Performance comparison with related work on the UNSW-NB15 dataset. **Author Contributions:** Conceptualization, S.N., T.B. and T.T. ; methodology, S.N., T.B. and T.T.