Enhancing Alert Prioritization in Enterprise Security Operations via Factor Graph Modeling

Advanced Persistent Threats (APTs) remain one of the most challenging problems in enterprise cybersecurity due to their stealthy, multi-stage nature and ability to evade traditional detection methods. While existing systems like RANK utilize factor graph-based scoring to correlate alerts into actionable incident graphs, they rely on static, manually defined tactic transition weights, limiting adaptability to emerging attack pat- terns. In this paper, we propose an enhancement to the RANK architecture by introducing an adaptive scoring mechanism based on pairwise factor graphs. Our approach dynamically models contextual and temporal relationships between MITRE ATT&CK tactics, enabling more accurate and flexible incident evaluation. Experiments conducted on two enterprise-scale datasets show that our method improves detection precision and F1 scores while maintaining compatibility with real-world alert streams. These results demonstrate the potential of adaptive, context- aware scoring in reducing false positives and enhancing threat detection capabilities in modern Security Operations Centers.