Security Operation Centres (SOC) are a cyber security management solution typically utilised in conjunction with Security Information and Event Management (SIEM) tool suites in order to effectively respond to security threats. Due to the rising prevalence of cyber security events, SOC analysts face significant noise within their day-to-day operations risking alert fatigue which may impact their ability to respond effectively to threats. The embedding of Artificial Intelligence (AI) based tooling offers a synergistic solution to this contemporary challenge as AI can triage data at scale enabling analysts greater ease in distinguishing incidents from events. This research project seeks to ascertain what opportunities AI presents within traditional SOCs, as well as the challenges organisations may face in adoption. This will be achieved through the analysis of contemporary research in this field, focusing on topics associated with SIEM technologies, Human-AI Teaming (HAT), and positive identification, in the form of a literature review. Additionally, this research project seeks to ascertain how differing levels of AI integration impact the value of AI integration within SOCs.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Integrating Artificial Intelligence into Security Operation Centres

  • Liam Fifield,
  • P. W. C. Prasad

摘要

Security Operation Centres (SOC) are a cyber security management solution typically utilised in conjunction with Security Information and Event Management (SIEM) tool suites in order to effectively respond to security threats. Due to the rising prevalence of cyber security events, SOC analysts face significant noise within their day-to-day operations risking alert fatigue which may impact their ability to respond effectively to threats. The embedding of Artificial Intelligence (AI) based tooling offers a synergistic solution to this contemporary challenge as AI can triage data at scale enabling analysts greater ease in distinguishing incidents from events. This research project seeks to ascertain what opportunities AI presents within traditional SOCs, as well as the challenges organisations may face in adoption. This will be achieved through the analysis of contemporary research in this field, focusing on topics associated with SIEM technologies, Human-AI Teaming (HAT), and positive identification, in the form of a literature review. Additionally, this research project seeks to ascertain how differing levels of AI integration impact the value of AI integration within SOCs.