Post details algorithmic generation of false-positive alert filters
Original title: Filter generation in practice: from algorithms to LLMs
FP-Growth ranks field combinations from a detection rule's context and offers analysts the top three candidate filters.
A Securelist post describes automating filters that mark security alerts as false positives so analysts spend less time writing rules by hand. The generator drops irrelevant fields from events that average about 400 fields, normalizes strings such as file paths, and uses FP-Growth to rank frequent field combinations. Filters that mirror a detection rule are avoided so the rule is not disabled. The algorithmic method is deterministic and has no model dependency, but it cannot build a filter without prior context and string normalization misses atypical cases. The excerpt ends as it turns to large language models.
Unconfirmed: The excerpt ends before the large language model comparison, so that approach is not described.
- Events average about 400 fields, and only a few are kept for filtering.
- FP-Growth builds a tree of frequent fields and discards rare ones.
- The generator offers the analyst the top three ranked combinations.
- A first-ever rule trigger has no context, so no filter can be created.
- Organizations
- Kaspersky
From the original article
8 min read at securelist.com
We automate filter generation for security alerts using an algorithm, a large language model, and a group of LLM agents.
By Artemy Obukhov · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.