Alert Economy Attacks: Flooding, Suppression, and Prioritization Gaming

Every autonomous SOC platform operates under a constraint that its designers know well but rarely state as a security property: there is a maximum number of alerts the system can process per unit of time, and there is a scoring function that determines which alerts it acts on when that limit is approached. These two properties — finite queue capacity and severity-ranked triage — are architectural necessities, not bugs. But they are also an attack surface. An adversary who understands the queue capacity and the scoring function can make deliberate choices about how visible to be: invisible (suppression), overwhelmingly noisy (flooding), or deceptively low-priority (prioritization gaming). Each strategy is a rational response to a specific deployment configuration. This article names and formalizes the alert economy — the bounded resource that all three strategies attack — and builds the defenses that escape each class.

The Alert Economy: Finite Attention as an Attack Surface

The term alert economy describes the bounded capacity of a SOC platform to process and act on security alerts within a time window. In a human-staffed SOC, this capacity is measured in analyst-hours. In an autonomous SOC, it is characterized by the alert queue depth, the triage throughput of the AI decision engine, and the prioritization function that determines which alerts receive autonomous action before the queue's retention window expires. All three quantities are bounded and therefore economically scarce. Scarcity in any resource creates the conditions for adversarial exploitation: an attacker who can control the allocation of that resource against the defender's interests gains an advantage.

The alert economy concept extends a line of analysis established by Sommer and Paxson (2010), who documented the base-rate problem in network intrusion detection: at a 1% false-positive rate, a busy network generates more spurious alerts per hour than a human analyst team can review, creating a structural bottleneck regardless of detection model accuracy. Autonomous SOC platforms partially address this by automating the triage layer — the AI decision engine processes alerts at machine speed. But they do not eliminate the finite-attention constraint; they shift it from human-analyst time to AI decision capacity and autonomous action slots. The fundamental vulnerability remains: the alert economy is bounded, and an adversary who operates with knowledge of that bound can allocate events to exploit the bound.

NIST AI 100-1 (2023) identifies resource exhaustion and input manipulation as primary risk categories for AI systems deployed in consequential automated decision-making contexts. The alert economy attacks described in this article instantiate both categories simultaneously: they exhaust the alert processing resource (flooding), deplete the input signal (suppression), or corrupt the allocation function (prioritization gaming). Each is structurally distinct from a direct attack on the AI model's parameters or architecture.

Three Attack Classes: A Taxonomy

Alert economy attacks decompose into three classes based on the attacker's strategy with respect to the alert budget.

Alert flooding generates alert events at a rate that exceeds the queue's processing capacity, burying true-positive signals in noise. The attacker's goal is not to avoid detection — the flooding events may themselves generate detections — but to ensure that the critical true-positive alert is deprioritized or expires from the queue before the autonomous triage engine processes it. The attacker trades alert visibility for temporal burial.

Alert suppression operates at the opposite extreme: the attacker constrains their behavior to fall below every detection threshold, generating zero observable alerts. The attacker's goal is to remain entirely invisible to the alert generation layer. This requires knowledge of, or inference about, the detection thresholds and the behavioral baseline. A key property of suppression is that it can be detected only by its absence — the presence of a known-compromised asset with an anomalously low alert rate is itself a suspicious signal.

Prioritization gaming manipulates the signals that drive alert severity ranking without necessarily affecting alert volume. The attacker generates a true-positive alert — their activity is detectable — but accompanies it with signals that cause the autonomous triage engine to assign it a low severity score. The alert is visible in the queue but processed last, by which point the exploitation window has closed or the alert has aged out. Of the three classes, prioritization gaming is the most nuanced because it requires the attacker to influence the triage engine's scoring function while still generating observable activity.

Alert Flooding: Overwhelming the Queue

An alert flooding attack exploits the finite queue capacity of the autonomous SOC. The attacker generates events at a rate sufficient to fill the alert queue, either causing the queue to drop low-priority alerts (a head-of-line blocking effect) or exhausting the triage engine's processing time, leaving a true-positive alert unactioned before it ages out of the retention window.

The attacker's resource cost for flooding is substantially lower than for the defense. The triage engine must process every queued alert to determine whether it is a true positive; the attacker generates noise events at a marginal cost proportional only to the cost of producing an observable event (e.g., generating DNS queries, producing Windows Event Log entries, or making authenticated HTTP requests). In environments where the event generation cost is near zero — any attacker with code execution on an endpoint — the cost asymmetry favors the attacker.

Rubinstein et al. (2009), analyzing poisoning attacks against statistical anomaly detectors, demonstrated that an attacker who can inject events into the training or evaluation distribution at a volume proportional to the nominal input rate can systematically shift the detector's behavior. Alert flooding applies a similar volume-based principle to the triage queue: by shifting the composition of the queue toward noise, the attacker shifts the probability that any random queue slot is occupied by their true-positive alert rather than noise. The true-positive alert is not deleted — it is diluted.

A specific variant of alert flooding is temporal burial: the attacker floods the queue immediately after executing the target action, so that the true-positive alert generated by the action is produced at a moment of peak queue saturation. The alert enters the queue at the end of a flood burst, receives a low position due to the queue's ordering policy, and ages out of the retention window before being processed. This variant requires timing precision but not sustained flooding — a short burst synchronized with the target action is sufficient.

Alert Suppression: Operating Below the Detection Floor

Alert suppression attacks operate at the opposite extreme of the alert economy: the attacker constrains their activities to produce zero observable alerts. This requires either (a) operating at a rate and behavioral pattern that falls below every detection threshold in the environment, or (b) actively identifying and honoring those thresholds through trial-and-error profiling.

The suppression problem is formally related to the threshold evasion studied by Sommer and Paxson (2010): a detector must set its threshold T such that the false-positive rate is acceptable at the given alert volume. Lowering T reduces false positives but increases false negatives — events that the attacker produces below T are, by definition, undetectable by the threshold-based engine. A patient attacker who profiles the detection floor — the minimum event rate or anomaly score that triggers an alert — and stays below it at all times is structurally invisible to that detection layer.

Suppression is most effective against threshold-based and rate-based detectors (which have explicit floors) and least effective against behavioral baseline detectors (which detect deviation from normal activity in either direction — including anomalously low activity). An asset that has been compromised but is generating zero alerts is, for a sophisticated behavioral baseline, itself anomalous: its absence from the alert stream is a signal. Apruzzese et al. (2023) describe several cases in which ML-based security systems successfully flag anomalously quiet periods as potential suppression activity, though this detection approach requires a sufficiently long historical baseline to distinguish legitimate quiet periods from suppressed activity.

The critical operational window for suppression attacks is the dwell period — the time between initial compromise and the target action. During dwell, the attacker must maintain suppression consistently. A single slip outside the threshold generates a detection event that can trigger retrospective analysis of the quiet preceding period.

Prioritization Gaming: Manipulating the Severity Signal

Prioritization gaming represents the most sophisticated alert economy attack class. Rather than eliminating the alert (suppression) or burying it in volume (flooding), the attacker allows a true-positive alert to be generated but manipulates the signals that determine its severity score, ensuring it is ranked below the autonomous action threshold or processed only after the exploitation window has closed.

The scoring function of a modern autonomous SOC triage engine is a composite of multiple signals: behavioral anomaly score, threat intelligence enrichment (does the involved asset appear on an IOC feed?), asset criticality (is this a high-value target?), and contextual signals (is this activity correlated with other recent alerts?). Prioritization gaming targets the composite signal rather than any individual detector. An attacker who can influence even one component of the scoring function can shift the composite score enough to push their alert below the action threshold.

The practical attack surface for prioritization gaming is the enrichment layer. Threat intelligence feeds are the easiest signal to game: an attacker who ensures that their infrastructure does not appear on any public IOC feed — by using infrastructure that has not previously been used in known attacks, by rotating through clean infrastructure, or by using compromised legitimate accounts — reduces the threat-intelligence component of their alert's severity score to zero. Asset criticality signals are harder to manipulate but can be targeted by attacking through a low-criticality path: if the direct path to a high-value target requires traversing a low-criticality asset, an action taken on the low-criticality asset will receive a lower severity score than the same action taken directly on the high-value target.

Biggio and Roli (2018) describe the general principle: adversarial inputs that exploit the gap between the model's training distribution and the deployment distribution achieve higher evasion rates. In prioritization gaming, the equivalent gap is between the threat intelligence signals the scoring function was designed to match (known-malicious indicators) and the attacker's operational profile (clean infrastructure, legitimate accounts, low-criticality initial access paths).

Formal Analysis: The Alert Budget Constraint

Let Q be the alert queue, with maximum depth D_max (events) and a retention window of τ seconds. The queue's sustainable processing rate is R_triage (events per second). Define the alert budget B = D_max / τ as the maximum steady-state alert generation rate the queue can absorb without overflow. Any source or combination of sources generating alerts at a rate R > B causes the queue to overflow, with the overflow policy (drop-oldest, drop-lowest-priority, or block) determining which alerts are lost.

A flooding attack succeeds when the attacker's alert generation rate R_attack causes B to be exceeded in the queue's retention window: R_legitimate + R_attack > B. Solving for the minimum flooding rate: R_attack > B - R_legitimate. In environments with high baseline alert rates (high R_legitimate), the flooding threshold is low — a relatively small injection of noise events is sufficient to push the queue over budget. In quiet environments, the flooding threshold is higher but the attacker has fewer noise sources to blend into.

A suppression attack succeeds when all attacker-generated events produce anomaly scores below the lowest detection threshold θ_min of any active detector. This is independent of the alert budget — suppression removes the attacker from the alert stream entirely, rather than manipulating the queue's capacity allocation.

Prioritization gaming succeeds when the attacker can shift the composite priority score P(x_attack) of their true-positive alert to a value less than the autonomous action threshold θ_action, and the alert ages out of the queue before being manually reviewed. The attacker's margin is the difference between the time to queue expiry τ and the time to manual review T_review: if τ < T_review, even a correctly queued but low-priority alert will age out before any human examines it.

The three conditions are independent: a defense that addresses only one (e.g., rate-limiting R_attack to prevent flooding) does not prevent suppression or gaming. Robust defense requires addressing all three simultaneously, which corresponds to the requirement for the alert economy to be budget-secure, suppression-transparent, and scoring-robust.

Countermeasures: Defending the Alert Economy

A budget-secure alert economy requires three independent defensive properties. First, rate bounding: limits on per-source alert generation rates that prevent any single source from consuming a disproportionate fraction of the queue budget. Second, suppression transparency: bidirectional anomaly detection that treats anomalously low alert rates from active assets as equal candidates for investigation alongside high-rate anomalies. Third, scoring robustness: a priority scoring function that cannot be driven to a low value by the absence of threat-intelligence signals alone — it must require positive evidence of legitimacy, not merely the absence of known-bad indicators.

Each defensive property addresses exactly one attack class and is insufficient against the other two. Rate bounding stops flooding but does not prevent a patient attacker from operating sub-threshold (suppression) or with clean infrastructure (gaming). Suppression transparency catches quiet-period attacks but does not constrain flooding or gaming. Scoring robustness prevents gaming but does not address flooding or suppression. A robust alert economy must combine all three.

The practical architecture for a budget-secure, suppression-transparent, and scoring-robust autonomous SOC requires: (1) a rate-limiting layer at the alert ingestion stage that caps per-source contributions, (2) a heartbeat telemetry system for monitored assets that generates an alert on silence, and (3) a composite scoring function in which each signal component has both a minimum floor (to prevent suppression of a single component from zeroing the score) and a maximum weight (to prevent gaming by optimizing a single component).

Causal detection — the approach of asking whether an action is causally consistent with an asset's known function rather than statistically anomalous — is structurally resistant to all three attack classes. A causal rule fires regardless of the background alert rate (immune to flooding), fires on any action inconsistent with the asset's function regardless of whether other events are below threshold (immune to suppression), and produces a true-positive alert regardless of the threat intelligence score of the involved infrastructure (immune to prioritization gaming). The limitation is that causal detection requires a well-specified model of legitimate behavior for each monitored asset class — a non-trivial operational investment.

Limitations and Open Questions

This analysis assumes that the attacker has knowledge of, or can infer, the alert budget B and the scoring function's key inputs. In practice, this knowledge may be partial: the attacker knows what events they generate (observable through their own telemetry) but may not know the exact queue capacity, retention window, or composite scoring weights. Partial knowledge reduces the precision of flooding and gaming attacks but does not eliminate them — an attacker who generates events at a sustained high rate without knowing B exactly will still eventually exceed B, and an attacker who systematically cleans their infrastructure without knowing the exact scoring weights will still reduce their score.

The suppression detection countermeasures assume that monitored assets have consistent baseline activity. In environments with highly variable baseline behavior — intermittent production jobs, seasonal activity patterns, on-call infrastructure — distinguishing genuine quiet periods from suppression requires substantially longer historical baselines and more sophisticated change-point detection models. The mechanisms for this are documented in the anomaly-detection literature but are not standard in current autonomous SOC deployments.

The interaction between the three attack classes has not been analyzed formally: an attacker who combines flooding, suppression, and gaming simultaneously — flooding some channels while suppressing others and gaming the priority scores of the visible alerts — creates a composite attack surface that may require more than three independent defenses to address. That combination attack is the natural extension of this analysis and constitutes an open research question.

Practitioner Toolkit

Copy-paste, strictly defensive artifacts you can use today. Nothing here attacks a real system.

# Alert Economy Adversarial Probe Harness
# Tests flooding, suppression, and prioritization gaming resistance
# MUST NOT run against production systems

SOC = connect_to_staging_soc()  # staging copy with read-write test hooks
CANARY_ALERT = synthesize_alert(
    severity='HIGH', asset='canary-server-01', action='canary-file-access'
)

# TEST 1: Flooding resistance
function test_flooding():
    rate_multiplier = 10  # 10x normal alert rate
    synthetic_noise = generate_noise_alerts(volume=rate_multiplier * SOC.baseline_rate)
    SOC.inject(synthetic_noise)
    SOC.inject(CANARY_ALERT)
    result = SOC.wait_for_action(CANARY_ALERT, timeout=SOC.retention_window)
    if result == ACTIONED:
        return PASS
    report_failure('FLOODING: canary buried at 10x noise rate')
    return FAIL

# TEST 2: Suppression transparency
function test_suppression():
    SOC.silence_source('canary-server-01', duration=SOC.suppression_window)
    result = SOC.check_suppression_alert('canary-server-01', after=SOC.suppression_window)
    if result == SUPPRESSION_DETECTED:
        return PASS
    report_failure('SUPPRESSION: anomalous silence not detected')
    return FAIL

# TEST 3: Prioritization gaming resistance
function test_priority_gaming():
    low_priority_alert = synthesize_alert(
        severity='HIGH', asset='canary-server-01', action='canary-file-access',
        ioc_match=False, asset_criticality='low'
    )
    SOC.inject(low_priority_alert)
    result = SOC.get_priority_score(low_priority_alert)
    if result.score >= SOC.autonomous_action_floor:
        return PASS
    report_failure(f'GAMING: canary scored {result.score}, below action floor')
    return FAIL

for test in [test_flooding, test_suppression, test_priority_gaming]:
    result = test()
    assert result == PASS

Glossary

Alert Economy

The bounded capacity of a SOC platform to generate, process, and act on security alerts within a time window, treated as a scarce resource that adversaries can allocate against the defender's interests.

Alert Budget (B)

The maximum sustainable alert generation rate a queue can absorb without overflow, defined as the queue's maximum depth divided by its retention window.

Alert Flooding

An attack that generates events at a rate exceeding the alert budget, burying true-positive alerts in noise or causing them to age out of the retention window before triage.

Alert Suppression

An attack that constrains all attacker activity to below every active detection threshold, producing zero observable alerts and remaining invisible to the alert generation layer.

Prioritization Gaming

An attack that generates a detectable true-positive alert while manipulating the severity scoring signals to assign it a low priority, causing it to expire before autonomous action is taken.

Temporal Burial

A flooding variant in which a short event burst is synchronized with the target action so the true-positive alert enters the queue at peak saturation and ages out before triage.

Suppression Transparency

A detection property in which anomalously low alert rates from active assets are treated as equal candidates for investigation alongside high-rate anomalies.

Scoring Robustness

A property of a priority scoring function in which each signal component has a minimum floor value, preventing an attacker who optimizes any single component to zero from driving the composite score to zero.

References

1. MITRE ATLAS: Adversarial Threat Landscape for AI Systems
2. OWASP Agentic Security Initiative: Agentic AI Threats and Mitigations (2025)
3. OWASP Top 10 for LLM Applications (2025)
4. NIST AI 100-1: Artificial Intelligence Risk Management Framework (AI RMF 1.0)
5. Sommer & Paxson — Outside the Closed World: On Using Machine Learning for Network Intrusion Detection (IEEE S&P, 2010)
6. Rubinstein et al. — ANTIDOTE: Understanding and Defending Against Poisoning of Anomaly Detectors (IMC, 2009)
7. Biggio & Roli — Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning (Pattern Recognition, 2018)
8. Apruzzese et al. — The Role of Machine Learning in Cybersecurity (Digital Threats: Research and Practice, 2023)