In the cyber security operations of a typical organization, data from multiple sources are monitored, and when certain conditions in the data are met, an alert is generated in an alert management system. Analysts inspect these alerts to decide if any deserve promotion to an event requiring further scrutiny. This triage process is manual, time-consuming, and detracts from the in-depth investigation of events. We have created a software system that uses supervised machine learning to automatically prioritize these alerts. In particular we utilize active learning to make efficient use of the pool of unlabeled alerts, thereby improving the performance of our ranking models over passive learning. We have demonstrated the effectiveness of our system on a large, real-world dataset of cyber security alerts.
To initiate an order for this software, request consultation services, or receive further information, fill out the request form below. You may also reach us by email at: .
ESTSC staff will begin to process an order for scientific and technical software once the payment and signed site license agreement are received. If the forms are not in order, ESTSC will contact you. No further action will be taken until all required information and/or payment is received. Orders are processed within three to five business days.
Software Package Details
Title: Alert Triage v 0.1 beta
Some links on this page may take you to non-federal websites. Their policies may differ from this site.