安全运营团队终于有了一个可解释、可调参的告警优先级方案，能直接缓解告警疲劳问题，做SOC分析的建议点开看看实验效果。
现代入侵检测系统每天产生数千条告警，但大量误报和低影响事件导致告警疲劳，严重制约安全运营效率。该论文提出一种基于亚正态模糊数的告警优先级排序框架，显式建模威胁严重性、检测置信度和组织风险态度三种不确定性来源。每个告警被表示为模糊数，核心表示严重性，扩散表示不确定性，高度反映检测可靠性。通过排序指标进行优先级排序，并允许组织通过风险态度参数调整安全姿态。在CIC-IDS2017和NSL-KDD数据集上的实验表明，该框架在检测器退化情况下比基线方法更鲁棒（NDCGrel@100为0.9963 vs 0.8215），且在中置信度告警中具有明显区分度。
Risk Averse Alert Prioritization for IDS Using Subnormal Gaussian Fuzzy Models
Modern intrusion detection systems generate thousands of alerts daily, but alert fatigue severely limits security operations effectiveness due to too many false positives or low-impact events. We address this by proposing a principled framework for alert prioritization based on subnormal Gaussian fuzzy numbers, explicitly modeling three sources of uncertainty: threat severity, detection confidence, and organizational risk attitude. Each alert is represented as a fuzzy number with the core indicating severity, spread indicating uncertainty, and height reflecting detection reliability. We apply ranking indices to prioritize alerts, allowing organizations to tune security posture through a risk-attitude parameter. Experimental validation on CIC-IDS2017 and NSL-KDD demonstrates greater robustness than baselines under detector degradation (0.9963 vs 0.8215 NDCGrel@100), with distinct differentiation in mid-confidence alerts and near-parity with baselines under robust detectors. The framework is theoretically grounded, computationally efficient, provides interpretable reasoning, and remains robust across detector families and miscalibration scenarios.