Adversary-Aware SOCs: Attack Modeling and a Novel Machine Learning Decision Framework for Enhanced Cyberattack Detection and Prevention
摘要
Modern Security Operations Centers (SOCs) continue to grapple with challenges including alert fatigue and analyst overload that hinder a proactive and contextual defense. This paper introduces a dual-aware SOC framework that brings together adaptive prioritization of alerts with modeling adversary intent, sourcing greater agility from human cognition and balance from machine intelligence. The prototype uses an annotated tweet dataset that embodies implicit aggression and violent semantics. Two learning models are obtained by a basic TF-IDF + Logistic Regression model and a sequential BiGRU network that adapts learning stability observed on smaller dataset sizes. The findings demonstrate that the baseline model obtains 97% accuracy while the BiGRU model achieves 99.5% accuracy with balanced recall, improving detection of minority (violent) classes and contextual awareness. These conclusions indicate the potential of dual-aware, decision-driven SOCs, which will lead to technologically supported cognitive resilient security operations.