Automated detection of cyber attacks is a critical capability to counteract the growing volume and sophistication of cyber attacks. However, the high numbers of security alerts issued by intrusion detection systems lead to alert fatigue among analysts working in security operations centres (SOC), which in turn causes slow reaction time and incorrect decision making. Alert grouping, which refers to clustering of security alerts according to their underlying causes, can significantly reduce the number of distinct items analysts have to consider. Unfortunately, conventional time-based alert grouping solutions are unsuitable for large scale computer networks characterised by high levels of false positive alerts and simultaneously occurring attacks. To address these limitations, we propose AlertBERT, a self-supervised framework designed to group alerts from isolated or concurrent attacks in noisy environments. Thereby, our open-source implementation of AlertBERT leverages masked-language-models and density-based clustering to support both real-time or forensic operation. To evaluate our framework, we further introduce a novel data augmentation method that enables flexible control over noise levels and simulates concurrent attack occurrences. Based on the data sets generated through this method, we demonstrate that AlertBERT consistently outperforms conventional time-based grouping techniques, achieving superior accuracy in identifying correct alert groups.

翻译：网络攻击的自动化检测是应对日益增长的网络攻击数量和复杂性的关键能力。然而，入侵检测系统产生的大量安全告警会导致安全运营中心的分析师产生告警疲劳，进而导致响应速度慢和决策失误。告警分组，即根据安全告警的根本原因对其进行聚类，可以显著减少分析师需要处理的不同告警项的数量。遗憾的是，传统的基于时间的告警分组解决方案不适用于具有高误报告警和并发攻击特征的大规模计算机网络。为了解决这些局限性，我们提出了AlertBERT，这是一个自监督框架，旨在对噪声环境中来自孤立或并发攻击的告警进行分组。为此，我们开源的AlertBERT实现利用了掩码语言模型和基于密度的聚类，以支持实时或事后取证操作。为了评估我们的框架，我们进一步引入了一种新颖的数据增强方法，该方法能够灵活控制噪声水平并模拟并发攻击的发生。基于通过此方法生成的数据集，我们证明AlertBERT在识别正确告警组方面始终优于传统的基于时间的分组技术，实现了更高的准确率。