AI/ML Models for Mitigating False Positives in Large-Scale Security Alert Systems

Abstract

Security warning systems in large companies must remove false positives, which harm SOC performance. This work solves using AI/ML. Chronicle Security AI and Datadog impact SOC research. Random Forests, Gradient Boosting Machines (GBMs), and Deep Neural Networks (DNNs) reduce false positives and improve threat identification in high-volume security. Analyst fatigue, resource allocation, and response priority are affected by false positives. Training alert filtering and classification. DNNs can learn complex patterns and correlations in multidimensional alert data, whereas ensemble learning can combine weak learners to generate strong prediction models.