Alert fatigue has caused serious consequences for enterprise security. When analysts are inundated with a vast number of alerts, high-risk alerts may be overlooked or responded to with delay, thereby exposing the organization to potential cyber threats or data breaches. Although there are many alert classification research focusing on reducing alerts, it’s still impossible to investigate all alerts due to the resource shortage. Therefore, it is necessary to prioritize alerts based on their potential severity, allowing analysts to address higher-risk alerts first. This paper proposes a novel alert risk rating DeepARR (Deep Learning-based Alert Risk Rating), that utilizes deep learning technology to rate alert risk levels in bulk instead of investigating each alert individually. It first employs a dynamic time window segmentation approach to merge alerts, reducing the overall number. Subsequently, a directed graph-based method is proposed to handle data imbalance. Both temporal-spatial features and event features are extracted. Finally, deep learning techniques are used to classify alert levels. The proposed method is evaluated on the public CPTC-2018 alert dataset. Compared with existing methods, DeepARR achieves an average precision of 95.73%, a recall of 94.83%, and an F1 Score of 94.84% in risk rating, demonstrating its higher effectiveness.

The low earth orbit (LEO) remote sensing satellite has a short communication time with the earth station (ES), and a large amount of remote sensing data cannot be transmitted back to the ES in time using the LEO-ES link during the communication period. Using relay satellites can indirectly increase the amount of data transmitted back from LEO. In this paper, we combine LEO- ES link and relay satellite offloading to study the problem of maximizing the amount of data transmitted back from LEO remote sensing satellites. Most of the existing methods do not consider the effect of topology change on policy. In this paper, we consider a three-layer satellite network architecture of geostationary earth orbit (GEO), LEO remote sensing satellite , and ES. We studied the problem of maximizing the amount of LEO transmitted back data under dynamic topology between layers, and proposed a transmission strategy based on a combination of LEO-ES link and GEO offload under dynamic topology. First, in order to reduce the number of link interruptions in each time slot, a Non-Uniform Time Slot Division Method (NUTSDM) based on visible relationships between layers is proposed based on discrete-time points, which helps to accurately determine the number and identity of LEOs competing under each time slot. Second, the relationship among GEOs, LEOs, and network administrators is modeled as a Stackelberg game model, and a Two-way Bargaining Game Scheme under Dynamic Topology (TWBGS-DT) is proposed to maximize the amount of data transmitted back from space. Compared with the existing methods, the experimental results confirm the effectiveness of the proposed scheme in terms of algorithm convergence speed, terms of pricing, GEO cache space allocation, and increase the data volume of LEO transmissions back by 11.5% and 8.2 times relative to the ISL-Aided strategy and GAA-FARR strategy, respectively.

With the reduction in manufacturing and launch costs of low Earth orbit satellites and the advantages of large coverage and high data transmission rates, satellites have become an important part of data transmission in air-ground networks. However, due to the factors such as geographical location and people’s living habits, the differences in user’ demand for multimedia data will result in unbalanced network traffic, which may lead to network congestion and affect data transmission. In addition, in traditional satellite network transmission, the convergence of network information acquisition is slow and global network information cannot be collected in a fine-grained manner, which is not conducive to calculating optimal routes. The service quality requirements cannot be satisfied when multiple service requests are made. Based on the above, in this paper artificial intelligence technology is applied to the satellite network, and a software-defined network is used to obtain the global network information, perceive network traffic, develop comprehensive decisions online through reinforcement learning, and update the optimal routing strategy in real time. Simulation results show that the proposed reinforcement learning algorithm has good convergence performance and strong generalizability. Compared with traditional routing, the throughput is 8% higher, and the proposed method has load balancing characteristics.