URL-SemCom: An Alert Identification Model Based on URL Semantic Comprehension

As power systems continue to expand, the number of security alerts generated by intrusion detection system (IDS) has surged, making it increasingly challenging for security operation analysts in identifying genuine network intrusions among the vast number of alerts. Existing methods typically rely on machine learning to classify alerts, but such models often lack interpretability. To address this issue, we propose a novel framework called URL-SemCom, which employs a language model to understand the semantic information within the Uniform Resource Locator (URL) in alerts. We expand the language model's vocabulary with commonly used URL terms and design a specialized enhancement task. Additionally, we propose a cost-sensitive strategy to mitigate the poor performance caused by the imbalance of positive and negative samples in real-world power system data during the model training process. Finally, we employ an Adaptive boosting (Adaboost) classifier to improve the model's accuracy in classifying high-dimensional vectors. Comprehensive experiments demonstrate that our method significantly enhances the effectiveness of alert identification, providing a robust tool for improving cybersecurity measures in power systems.