Let the Alerts Speak: LLM-Based IDS Alert Interpretation for SOC Triage

Engineering notes

Engineering notes will be added by the aipentium editorial team.

Chinese explanation / 中文解读

中文解读待补充：本站会优先为大语言模型、生成式AI、ChatGPT相关技术、计算机视觉、深度学习等高价值论文补充中文说明。

Original abstract

Abstract Interpreting the large volume of alerts produced by Intrusion Detection Systems (IDS) each day can be challenging and fatiguing for Security Operation Center (SOC) analysts, especially when encountering numerous false positives. Although modern SOC tooling supports alert aggregation, correlation, and enrichment, it provides limited semantic interpretation of alert content and rarely offers human-understandable explanations to support triage decisions. We therefore present a concept that leverages Large Language Models (LLMs) to classify IDS alerts and assist SOC analysts during triage. Of particular interest is the ability of LLMs to distinguish attack-related alerts from false positives and to associate alerts with attack techniques. We perform an empirical evaluation of the alert classification performance of the LLMs ChatGPT and Gemini on alerts from network-based and host-based IDS. We further examine how system context information such as additional logs, configuration data, and few-shot examples impact the LLM’s alert classification performance and consistency. Our results show that supplying LLMs with additional information, especially carefully chosen few-shot examples and system context, supports effective alert classification. At the same time, limitations related to cost, reliability, and sensitive data exposure could affect their practical use for alert interpretation.

Links and sources

Comments