Risk Averse Alert Prioritization for IDS Using Subnormal Gaussian Fuzzy Models
For security operations teams overwhelmed by alert fatigue, this framework provides a principled, interpretable, and robust prioritization method that outperforms baselines under realistic detector degradation.
The paper proposes a fuzzy-based alert prioritization framework for IDS that models uncertainty in threat severity, detection confidence, and risk attitude, achieving higher robustness (0.9963 vs 0.8215 NDCGrel@100) under detector degradation on CIC-IDS2017 and NSL-KDD datasets.
Modern intrusion detection systems generate thousands of alerts daily, but alert fatigue severely limits security operations effectiveness due to too many false positives or low-impact events. We address this by proposing a principled framework for alert prioritization based on subnormal Gaussian fuzzy numbers, explicitly modeling three sources of uncertainty: threat severity, detection confidence, and organizational risk attitude. Each alert is represented as a fuzzy number with the core indicating severity, spread indicating uncertainty, and height reflecting detection reliability. We apply ranking indices to prioritize alerts, allowing organizations to tune security posture through a risk-attitude parameter. Experimental validation on CIC-IDS2017 and NSL-KDD demonstrates greater robustness than baselines under detector degradation (0.9963 vs 0.8215 NDCGrel@100), with distinct differentiation in mid-confidence alerts and near-parity with baselines under robust detectors. The framework is theoretically grounded, computationally efficient, provides interpretable reasoning, and remains robust across detector families and miscalibration scenarios.