Effective Noise Reduction in NDR Systems: A Simple Yet Powerful Apriori-Based Approach

Area of Science:

• Cybersecurity
• Data Science
• Network Security

Background:

• Noise alerts are a significant challenge in intrusion detection systems, leading to analyst overload and potential system disruptions.
• Real-world alerts often stem from routine software or user activities, not actual security compromises.

Purpose of the Study:

• To propose and validate an approach for reducing noise alerts in Network Detection and Response (NDR) systems.
• To demonstrate that simpler algorithms can effectively address the challenge of noise alerts.

Main Methods:

• An Apriori-based algorithm was developed to identify frequent, long-term security alerts meeting specific frequency criteria.
• The approach was tested on real-world data from a Danish NDR solution customer.
• Performance was evaluated by comparing noise levels before and after applying the proposed solution.

Main Results:

• The Apriori-based method successfully reduced noise alerts across most alert types for a real customer.
• Over 40% of alerts were filtered by setting a minimum occurrence threshold of 70%.
• Certain alert categories experienced a noise reduction exceeding 90%.

Conclusions:

• Frequent security alerts meeting defined criteria can be effectively classified as noise.
• Simpler algorithmic solutions, like the Apriori-based approach, are viable and efficient for reducing noise in NDR systems.
• The proposed method offers a high-performance solution for noise reduction in practical NDR environments.