{"id":"https://openalex.org/W7162523857","doi":"https://doi.org/10.48550/arxiv.2605.27299","title":"Risk Averse Alert Prioritization for IDS Using Subnormal Gaussian Fuzzy Models","display_name":"Risk Averse Alert Prioritization for IDS Using Subnormal Gaussian Fuzzy Models","publication_year":2026,"publication_date":"2026-05-26","ids":{"openalex":"https://openalex.org/W7162523857","doi":"https://doi.org/10.48550/arxiv.2605.27299"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.27299","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.27299","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.27299","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5021760853","display_name":"Murat Moran","orcid":"https://orcid.org/0000-0001-5557-4827"},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Moran, Murat","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5021760853"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.7603999972343445,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.7603999972343445,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.125,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12391","display_name":"Artificial Immune Systems Applications","score":0.015699999406933784,"subfield":{"id":"https://openalex.org/subfields/2204","display_name":"Biomedical Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/false-positive-paradox","display_name":"False positive paradox","score":0.7028999924659729},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.6996999979019165},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.66839998960495},{"id":"https://openalex.org/keywords/fuzzy-logic","display_name":"Fuzzy logic","score":0.6424000263214111},{"id":"https://openalex.org/keywords/prioritization","display_name":"Prioritization","score":0.6014000177383423},{"id":"https://openalex.org/keywords/detector","display_name":"Detector","score":0.46639999747276306},{"id":"https://openalex.org/keywords/ranking","display_name":"Ranking (information retrieval)","score":0.4562999904155731}],"concepts":[{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.7028999924659729},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.6996999979019165},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6898000240325928},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.66839998960495},{"id":"https://openalex.org/C58166","wikidata":"https://www.wikidata.org/wiki/Q224821","display_name":"Fuzzy logic","level":2,"score":0.6424000263214111},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.6119999885559082},{"id":"https://openalex.org/C2777615720","wikidata":"https://www.wikidata.org/wiki/Q11888847","display_name":"Prioritization","level":2,"score":0.6014000177383423},{"id":"https://openalex.org/C94915269","wikidata":"https://www.wikidata.org/wiki/Q1834857","display_name":"Detector","level":2,"score":0.46639999747276306},{"id":"https://openalex.org/C189430467","wikidata":"https://www.wikidata.org/wiki/Q7293293","display_name":"Ranking (information retrieval)","level":2,"score":0.4562999904155731},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.414000004529953},{"id":"https://openalex.org/C163716315","wikidata":"https://www.wikidata.org/wiki/Q901177","display_name":"Gaussian","level":2,"score":0.40779998898506165},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3869999945163727},{"id":"https://openalex.org/C164226766","wikidata":"https://www.wikidata.org/wiki/Q7293202","display_name":"Rank (graph theory)","level":2,"score":0.3772999942302704},{"id":"https://openalex.org/C112789634","wikidata":"https://www.wikidata.org/wiki/Q18207010","display_name":"False positives and false negatives","level":3,"score":0.3515999913215637},{"id":"https://openalex.org/C61224824","wikidata":"https://www.wikidata.org/wiki/Q2260434","display_name":"Mixture model","level":2,"score":0.2854999899864197},{"id":"https://openalex.org/C2989486834","wikidata":"https://www.wikidata.org/wiki/Q3808900","display_name":"True positive rate","level":2,"score":0.28049999475479126},{"id":"https://openalex.org/C195975749","wikidata":"https://www.wikidata.org/wiki/Q1475705","display_name":"Fuzzy control system","level":3,"score":0.2768999934196472},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2578999996185303},{"id":"https://openalex.org/C61326573","wikidata":"https://www.wikidata.org/wiki/Q1496376","display_name":"Gaussian process","level":3,"score":0.2502000033855438}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.27299","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.27299","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.27299","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.27299","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.6579130291938782,"display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Modern":[0],"intrusion":[1],"detection":[2,51,76],"systems":[3],"generate":[4],"thousands":[5],"of":[6,47],"alerts":[7,118],"daily,":[8],"but":[9],"alert":[10,35,58],"fatigue":[11],"severely":[12],"limits":[13],"security":[14,89],"operations":[15],"effectiveness":[16],"due":[17],"to":[18,82,87],"too":[19],"many":[20],"false":[21],"positives":[22],"or":[23],"low-impact":[24],"events.":[25],"We":[26,78],"address":[27],"this":[28],"by":[29],"proposing":[30],"a":[31,62,92],"principled":[32],"framework":[33,127],"for":[34],"prioritization":[36],"based":[37],"on":[38,97],"subnormal":[39],"Gaussian":[40],"fuzzy":[41,63],"numbers,":[42],"explicitly":[43],"modeling":[44],"three":[45],"sources":[46],"uncertainty:":[48],"threat":[49],"severity,":[50,69],"confidence,":[52],"and":[53,73,99,119,136,142],"organizational":[54],"risk":[55],"attitude.":[56],"Each":[57],"is":[59,128],"represented":[60],"as":[61],"number":[64],"with":[65,113,121],"the":[66],"core":[67],"indicating":[68,71],"spread":[70],"uncertainty,":[72],"height":[74],"reflecting":[75],"reliability.":[77],"apply":[79],"ranking":[80],"indices":[81],"prioritize":[83],"alerts,":[84],"allowing":[85],"organizations":[86],"tune":[88],"posture":[90],"through":[91],"risk-attitude":[93],"parameter.":[94],"Experimental":[95],"validation":[96],"CIC-IDS2017":[98],"NSL-KDD":[100],"demonstrates":[101],"greater":[102],"robustness":[103],"than":[104],"baselines":[105,122],"under":[106,123],"detector":[107,140],"degradation":[108],"(0.9963":[109],"vs":[110],"0.8215":[111],"NDCGrel@100),":[112],"distinct":[114],"differentiation":[115],"in":[116],"mid-confidence":[117],"near-parity":[120],"robust":[124,138],"detectors.":[125],"The":[126],"theoretically":[129],"grounded,":[130],"computationally":[131],"efficient,":[132],"provides":[133],"interpretable":[134],"reasoning,":[135],"remains":[137],"across":[139],"families":[141],"miscalibration":[143],"scenarios.":[144]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-05-28T00:00:00"}