# A Graph-Based Approach to Alert Contextualisation in Security Operations Centres

arXiv: https://arxiv.org/abs/2509.12923 · HTML: https://mlsanity.com/paper/2509.12923/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 7 of its 35 references that are in the map.
- First posted on arXiv 16 Sep 2025.

## Builds on (most cited first, 7 of 7)

- [Graph Matching Networks for Learning the Similarity of Graph Structured Objects](https://mlsanity.com/paper/1904.12787/) (2019)
- [Characterizing Concept Drift](https://mlsanity.com/paper/1511.03816/) (2015)
- [Introducing a New Alert Data Set for Multi-Step Attack Analysis](https://mlsanity.com/paper/2308.12627/) (2023)
- [Maintainable Log Datasets for Evaluation of Intrusion Detection Systems](https://mlsanity.com/paper/2203.08580/) (2022)
- [A Practical Tutorial on Graph Neural Networks](https://mlsanity.com/paper/2010.05234/) (2020)
- [That Escalated Quickly: An ML Framework for Alert Prioritization](https://mlsanity.com/paper/2302.06648/) (2023)
- [Automated Alert Classification and Triage (AACT): An Intelligent System for the Prioritisation of Cybersecurity Alerts](https://mlsanity.com/paper/2505.09843/) (2025)

## Built on by (most cited first, 2 of 2)

- [AlertBERT: A noise-robust alert grouping framework for simultaneous cyber attacks](https://mlsanity.com/paper/2602.06534/) (2026)
- [From Noise to Signal: Improving Security Log Anomaly Detection Using LLMs with Endpoint-Specific Logs](https://mlsanity.com/paper/2608.19938/) (2026)

## Abstract (arXiv)

Interpreting the massive volume of security alerts is a significant challenge in Security Operations Centres (SOCs). Effective contextualisation is important, enabling quick distinction between genuine threats and benign activity to prioritise what needs further analysis. This paper proposes a graph-based approach to enhance alert contextualisation in a SOC by aggregating alerts into graph-based alert groups, where nodes represent alerts and edges denote relationships within defined time-windows. By grouping related alerts, we enable analysis at a higher abstraction level, capturing attack steps more effectively than individual alerts. Furthermore, to show that our format is well suited for downstream machine learning methods, we employ Graph Matching Networks (GMNs) to correlate incoming alert groups with historical incidents, providing analysts with additional insights.