关键词: 告警, 载荷, 可解释基线, 告警降噪, 安全运营

Abstract: The operators often filter alerts through some preset baseline rule groups in cybersecurity operation. It is difficult to deeply adapt to the specific network and business environment of the enterprise. With the continuous expansion of enterprise information services, the complex cyberattack is usually hidden in tons of alerts. It causes the alert fatigue, which reduces the efficiency of security operation center. We propose a cybersecurity alert baseline method based on intelligence algorithm to generate interpretable alert noise reduction baselines, which can filter alerts without understanding the company’s environment and business. It can improve the efficiency of cybersecurity operation. This method can effectively filter alerts in the actual production environment of a large company.

Key words: alert, payload, interpretable baseline, alert noise reduction, Security Operations