Graph Attention Autoencoder Aided Unsupervised Community Detection for Relieving Alert Fatigue

Intrusion detection system (IDS) is a security tool specifically designed to monitor and analyze network traffic to detect potential intrusions and attacks. However, due to volatile network traffic and imperfect rule signatures, IDS often generates high false positives, which overwhelms security analysts and reduces their efficiency. Therefore, reducing the false positives rate is critical to improving IDS performance. Traditionally, most of the methods for false alert rate reduction are based on supervised learning, but the effort of manually labeling alert data for large-scale network traffic datasets is really huge and costly. Therefore, unsupervised learning methods are potentially attractive in reducing the false alert rate because they do not require pre-labeled data. In this paper, we propose a novel framework GCRAF, an unsupervised approach designed to distinguish between normal alerts and false alerts. We introduce a community detection algorithm based on attribute network embedding considering topology and attribute information of attack nodes. In order to verify the validity of the proposed framework, we use two well-known datasets along with Snort as an intrusion detection system. The final results indicate that the GCRAF achieves satisfactory effectiveness and feasibility in eliminating false positives.