Let the Alerts Speak: LLM-Based IDS Alert Interpretation for SOC Triage

Abstract

Interpreting the large volume of alerts produced by Intrusion Detection Systems (IDS) each day can be challenging and fatiguing for Security Operation Center (SOC) analysts, especially when encountering numerous false positives. Although modern SOC tooling supports alert aggregation, correlation, and enrichment, it provides limited semantic interpretation of alert content and rarely offers human-understandable explanations to support triage decisions. We therefore present a concept that leverages Large Language Models (LLMs) to classify IDS alerts and assist SOC analysts during triage. Of particular interest is the ability of LLMs to distinguish attack-related alerts from false positives and to associate alerts with attack techniques. We perform an empirical evaluation of the alert classification performance of the LLMs ChatGPT and Gemini on alerts from network-based and host-based IDS. We further examine how system context information such as additional logs, configuration data, and few-shot examples impact the LLM’s alert classification performance and consistency. Our results show that supplying LLMs with additional information, especially carefully chosen few-shot examples and system context, supports effective alert classification. At the same time, limitations related to cost, reliability, and sensitive data exposure could affect their practical use for alert interpretation.