Security Operations Center Research Articles

Developing a shared SOC

A security operations centre (SOC) provides a critical security function to detect and defend from cyber security attacks. It is the last line of defence as part of an organisation's overall security control set. But not every organisation can, or should, run its own SOC.

Testing SOAR tools in use

Investigations within Security Operation Centers (SOCs) are tedious as they rely on manual efforts to query diverse data sources, overlay related logs, correlate the data into information, and then document results in a ticketing system. Security Orchestration, Automation, and Response (SOAR) tools are a relatively new technology that promise, with appropriate configuration, to collect, filter, and display needed diverse information; automate many of the common tasks that unnecessarily require SOC analysts’ time; facilitate SOC collaboration; and, in doing so, improve both efficiency and consistency of SOCs. There has been no prior research to test SOAR tools in practice; hence, understanding and evaluation of their effect is nascent and needed. In this paper, we design and administer the first hands-on user study of SOAR tools, involving 24 participants and six commercial SOAR tools. Our contributions include the experimental design, itemizing six defining characteristics of SOAR tools, and a methodology for testing them. We describe configuration of a cyber range test environment, including network, user, and threat emulation; a full SOC tool suite; and creation of artifacts allowing multiple representative investigation scenarios to permit testing. We present the first research results on SOAR tools. Concisely, our findings are that: per-SOC SOAR configuration is extremely important; SOAR tools increase efficiency and reduce context switching, although with potentially decreased ticketing accuracy/completeness; user preference is slightly negatively correlated with their performance with the tool; internet dependence varies widely among SOAR tools; and balance of automation with assisting decision making is preferred by senior participants. We deliver a public user- and tool-anonymized and -obfuscated version of the data.

Investigating on the robustness of flow-based intrusion detection system against adversarial samples using Generative Adversarial Networks

Recently, Software Defined Networking (SDN) has emerged as the key technology in programming and orchestrating security policy in the security operations centers (SOCs) for heterogeneous networks. Typically, machine learning-based intrusion detection systems (ML-IDS) have been deployed and associated with SDN to leverage the features of a programmable network to defend against sophisticated cyberattacks in anomaly detection. Unfortunately, such ML-based IDSs are easily vulnerable to adversarial attacks due to the lack of diverse forms of malicious records in the training dataset. The missing data sample in the training phase can lead to a lower detection rate in real-world scenarios with adversarial settings. In this paper, we explore the ability of Wasserstein Generative Adversarial Networks with Gradient Penalty (WGAN-GP), WGAN-GP with two timescale update rule (WGAN-GP TTUR), and AdvGAN in generating perturbed attack samples to bypass attack detectors. Then, this approach is used to continuously evaluate the robustness of ML-based IDSs and then upgrade them as a service in SDN. The experimental results on CICIDS2018 and InSDN datasets demonstrate that generated adversarial samples can be used to fool targeted IDS. Later, those created samples can supplement the original ones in retraining IDS to improve the resilience of the attack detector.

Data Auditing for Intelligent Network Security Monitoring

Data auditing is a process to consistently keep the quality of data high, but this process is generally missing in network security monitoring. When network-based intrusion detection systems catch any suspicious packet, they generate alert messages that are further investigated by security analysts. An alert is generally assigned to only one analyst at best, and then the analyst determines whether the alert is true or false, called labeling. Therefore, different analysts may label very similar alerts with different labels. In this article, we introduce this problem of inconsistent labeling in network security monitoring and present a new automatic data auditing method to check if any human mistake has occurred for the labeling. Through our experiments on two data sets, a private one from a real security operations center and an open data set for reproducible experiments, we confirm that the new auditing method can catch incorrect labels, and the accuracy of a machine learning model on the data set can be enhanced through the label correction.

A Framework Design to Improve the Operation Capability of Cyber Security for Electric Power Dispatching and Control Systems based on the Concept of SOC

Benefiting from the vision of the Security Operation Center (SOC), this paper proposes a construction plan for a cyber security operation center for the electric power dispatching and control system. This solution integrates and analyzes various data such as ledger database, knowledge database, and historical alarm database in the power dispatching and control system, and realizes the functions of alarm handling, risk assessment, and emergency response for the existing security management platform. Through the risk evaluation experiment, it is verified that our scheme has the function of overall interacted active security defense, and can effectively improve the cyber security risk resistance of the power dispatching and control system.

APIRO: A Framework for Automated Security Tools API Recommendation

Security Orchestration, Automation, and Response (SOAR) platforms integrate and orchestrate a wide variety of security tools to accelerate the operational activities of Security Operation Center (SOC). Integration of security tools in a SOAR platform is mostly done manually using APIs, plugins, and scripts. SOC teams need to navigate through API calls of different security tools to find a suitable API to define or update an incident response action. Analyzing various types of API documentation with diverse API format and presentation structure involves significant challenges such as data availability, data heterogeneity, and semantic variation for automatic identification of security tool APIs specific to a particular task. Given these challenges can have negative impact on SOC team’s ability to handle security incident effectively and efficiently, we consider it important to devise suitable automated support solutions to address these challenges. We propose a novel learning-based framework for automated security tool API R ecommendation for security O rchestration, automation, and response, APIRO . To mitigate data availability constraint, APIRO enriches security tool API description by applying a wide variety of data augmentation techniques. To learn data heterogeneity of the security tools and semantic variation in API descriptions, APIRO consists of an API-specific word embedding model and a Convolutional Neural Network (CNN) model that are used for prediction of top three relevant APIs for a task. We experimentally demonstrate the effectiveness of APIRO in recommending APIs for different tasks using three security tools and 36 augmentation techniques. Our experimental results demonstrate the feasibility of APIRO for achieving 91.9% Top-1 Accuracy. Compared to the state-of-the-art baseline, APIRO is 26.93%, 23.03%, and 20.87% improved in terms of Top-1, Top-2, and Top-3 Accuracy and outperforms the baseline by 23.7% in terms of Mean Reciprocal Rank (MRR).

A 3D mixed reality visualization of network topology and activity results in better dyadic cyber team communication and cyber situational awareness.

Cyber defense decision-making during cyber threat situations is based on human-to-human communication aiming to establish a shared cyber situational awareness. Previous studies suggested that communication inefficiencies were among the biggest problems facing security operation center teams. There is a need for tools that allow for more efficient communication of cyber threat information between individuals both in education and during cyber threat situations. In the present study, we compared how the visual representation of network topology and traffic in 3D mixed reality vs. 2D affected team performance in a sample of cyber cadets (N = 22) cooperating in dyads. Performance outcomes included network topology recognition, cyber situational awareness, confidence in judgements, experienced communication demands, observed verbal communication, and forced choice decision-making. The study utilized network data from the NATO CCDCOE 2022 Locked Shields cyber defense exercise. We found that participants using the 3D mixed reality visualization had better cyber situational awareness than participants in the 2D group. The 3D mixed reality group was generally more confident in their judgments except when performing worse than the 2D group on the topology recognition task (which favored the 2D condition). Participants in the 3D mixed reality group experienced less communication demands, and performed more verbal communication aimed at establishing a shared mental model and less communications discussing task resolution. Better communication was associated with better cyber situational awareness. There were no differences in decision-making between the groups. This could be due to cohort effects such as formal training or the modest sample size. This is the first study comparing the effect of 3D mixed reality and 2D visualizations of network topology on dyadic cyber team communication and cyber situational awareness. Using 3D mixed reality visualizations resulted in better cyber situational awareness and team communication. The experiment should be repeated in a larger and more diverse sample to determine its potential effect on decision-making.

ISMS ROLE IN THE IMPROVEMENT OF DIGITAL FORENSICS RELATED PROCESS IN SOC's

Organizations concerned about digital or computer forensics capability which establishes procedures and records to support a prosecution for computer crimes could benefit from implementing an ISO 27001: 2013-compliant (ISMS Information Security Management System). A certified ISMS adds credibility to information gathered in a digital forensics investigation; certification shows that the organization has an outsider which verifies that the correct procedures are in place and being followed. A certified ISMS is a valuable tool either when prosecuting an intruder or when a customer or other stakeholder seeks damages against the organization. SOC (Security Operation Center) as an organization or a security unit which handles a large volume of information requires a management complement, where ISMS would be a good choice. This idea will help finding solutions for problems related to digital forensics for non-cloud and cloud digital forensics, including Problems associated with the absence of standardization amongst different CSPs (Cloud service providers).

Combating Alert Fatigue in the Security Operations Centre

Combating Alert Fatigue in the Security Operations Centre

MACHINE LEARNING ALGORITHMS FOR DETECTION OF CYBER THREATS USING LOGISTIC REGRESSION

The threat of cyberattacks is expanding globally; thus, businesses are developing intelligent artificial intelligence systems that can analyze security and other infrastructure logs from their systems department and quickly and automatically identify cyberattacks. Security analytics based on machine learning the next big thing in cybersecurity is machine data, which aims to mine security data to show the high maintenance costs of static relationship rules and methods. But, choosing the appropriate machine learning technique for log analytics using ML continues to be a significant barrier to AI success in cyber security due to the possibility of a substantial number of false-positive detections in large-scale or global Security Operations Centre (SOC) settings, selecting the proper machine learning technique for security log analytics remains a substantial obstacle to AI success in cyber security. A machine learning technique for a cyber threat exposure system that can minimize false positives is required. Today's machine learning methods for identifying threats frequently use logistic regression. Logistic regression is the first of three machine learning subcategories—supervised, unsupervised, and reinforcement learning. Any machine learning enthusiast will encounter this supervised machine learning algorithm at the beginning of their machine learning career. It's an essential and often applied classification algorithm.

A MATURITY CAPABILITY FRAMEWORK FOR SECURITY OPERATION CENTER

Owning a Security Operation Center (SOC) is becoming increasingly common for organizations as part of their cybersecurity strategy to ensure near-real-time detection and adequately respond to cyber-attack engaging the SOC’s humans, technology, and processes. However, SOC investments only sometimes achieve the best possible outcomes and only provide an acceptable protection level in some cases due to the challenges related to the technologies, processes and especially the human factor. This paper proposes a new practical maturity framework for Security Operation Center. This will serve as a roadmap for IT auditors and security experts when they evaluate the maturity of a security operation center in terms of safeguarding the assets of the company, its partners, and its clients.

Understanding situation awareness in SOCs, a systematic literature review

Situation awareness is shown through human factors research to be a valuable construct to understand and improve how humans perform while operating complex systems in critical environments. Within cyber security one such environment is the Security Operations Center (SOC). With the increasing threat of hybrid warfare, knowledge about situation awareness within SOC environments, where human error or low performance may be detrimental, must be developed. This paper reports on the results of a Systematic Descriptive Literature Review of the current research on situation awareness within SOCs. The goal of the paper is to analyze how situation awareness is understood in the current research. To achieve this goal three aspects of understanding were addressed: Theoretical foundations; levels of conceptualization; and measurement of situation awareness. Theoretical foundations in the literature were assessed by how situation awareness was defined and the presence of references to theoretical models of SA. The results show a clear trend of basing the research on Endsley's three level situation awareness model; this model has been developed into a domain specific formulation called “Cyber Situation Awareness”. Some parts of the literature, particularly in research aimed at developing tools for improving situation awareness, lack a theoretical foundation; some refer to alternative theoretical foundations of situation awareness like Stanton et al.’s Distributed Situation Awareness. Further, a balance between conceptualizations on the individual, group and system level has been identified. Within research aimed at developing tools for improving situation awareness there are some examples of specialized and precise measurements of situation awareness, but in general the research seems too reliant on indirect measures of situation awareness. The paper concludes with the proposition of connecting the systems-based theoretical perspective of distributed situation awareness into the research, utilizing a systems level conceptualization of situation awareness. This might prove to be a useful bridge between the human cognitive perspective of situation awareness and the development of the complex technical environment of critical importance that SOCs represent.

Knowledge management for information security incident handling at Security Operation Center of Jakarta Provincial Government

Information security incidents have increased in number and become more diverse and destructive and disrupt service availability. An incident management system is needed to detect and handle information security incidents quickly, minimize losses, reduce exploited vulnerabilities and restore infrastructure, including services. An incident management system needs to be managed with a Security Operations Center (SOC). The use of tacit knowledge has been shown to help accelerate problem-solving in SOC better than experience by adopting strategies that have been used previously. The application of knowledge management in SOC has become a basic need. An organization's ability to manage existing knowledge is a necessary strength to be able to survive in the face of incessant cyber-attacks. This study aims to examine the process of capturing tacit in SOC so that it can be used to analyze and deal with cyber threats and to lay the foundation for implicit knowledge management in organizations to increase the efficiency of work methods and processes responding to incidents efficiently and systematically.

Deciphering Conti and the need for effective SOCs

Conti has proven to be one of the most virulent forms of ransomware. It has caused untold damage, and many organisations struggle to combat this kind of threat on their own. This is where a security partner, with an effective and experienced security operations centre (SOC), can play a key role.

On the application of active learning for efficient and effective IoT botnet detection

The active learning approach for machine learning can greatly benefit those environments where a wealth of unlabeled data is available, and the labeling cost of the data can be restrictive. In this regard, security operations centers (SOCs) can take advantage of the human expertise available to improve machine learning-based detection models using the active learning approach. In the context of SOC operations and IoT botnet detection, our study provides a thorough benchmarking of the application of different active learning approaches within the framework of pool-based sampling. The selection of the optimal query instance for learning is evaluated using uncertainty sampling, ranked batch-mode sampling, and query by committee strategies. Our results show that the active learning approach can help to generate better detection models using all the active learning query strategies tested in our benchmarking setup. Leveraging the human–machine interaction can produce high-performance models in the context of IoT botnet detection using significantly less data than the passive approaches traditionally used for the generation of machine learning-based detection systems. Additionally, the impact of wrong-labeled data in the active learning implementation is explored.

A systematic method for measuring the performance of a cyber security operations centre analyst

Analysts who work in a Security Operations Centre (SOC) play an essential role in supporting businesses to protect their computer networks against cyber attacks. To manage analysts efficiently and effectively, SOC managers and stakeholders use Key Performance Indicators (KPIs) to evaluate their performance. However, existing literature suggests a lack of a systematic approach for assessing analysts’ performance. Even though cyber security researchers advocate for research into this area, little effort has been made by researchers to address this gap. Drawing on the results of a Delphi panel with industry experts and the principles of the Analytic Hierarchy Process (AHP), this paper interrogates the problem and proposes a systematic weighted approach for measuring the performance of an analyst in a SOC. The proposed method, referred to as a SOC Analyst Assessment Method (SOC-AAM), was evaluated in two SOCs as a part of an experimental case study. The results of the empirical evaluation show that the SOC-AAM enables SOC managers and stakeholders to quantify and assess analysts’ performance in a systematic manner. The SOC-AAM also provides a novel guideline for assessing the quality of incident analysis and the quality of incident reports. This study will be of interest to practitioners and cyber security researchers seeking to understand the operations of a SOC analyst.

A CRITICAL EXAMINATION OF SHIELDING THE CYBERSPACE: A REVIEW ON THE ROLE OF AI IN CYBER SECURITY

This review focuses on the critical analysis of AI’s role in cybersecurity to investigate the issues in the cybersecurity space. By utilizing synchronous and scattered sources on the topic in question, the opinion paper focuses capacity on AI-embedded technologies to enhance cybersecurity and discourage cyber-attacks making critical infrastructure impenetrable by malicious persons [1]. The paper is concerned with applying AI solutions paired with research documenting theoretical outcomes obtained from academic sources, field reports, and practical case examples. Suggestions, pros, and cons of those solutions, as well as the implications, are presented. More importantly, the paper does not only touch on the ethical and policy aspects of AI application in cyber security, but there is also a need for a detailed approach to cyber security, an approach that unites technological innovation to privacy, transparency, and accountability [1]. In contrast, the article brings attention to future developments and innovations in AI-based cybersecurity, which is a crucial need of the hour. AI evolution is seen in different aspects, such as designing complex Machine Learning algorithms till the inclusion of AI in Security Operations Centers (SOCs) and Threat Intelligence Platforms, which have prepared reliable weapons for cyber defense systems.

The Intelligent Process Lifecycle of Active Cyber Defenders

“There are a thousand hacking at the branches of evil to one who is striking at the root.” Henry David Thoreau Successful information security requires careful application of tools to goals. The tools must be well used and well configured and require skillful interpretation of results. If problems occur in daily digital forensic workflows, then they must be documented in a systematic manner that aids process improvement. This article is the third in a series of three articles, where the connection between all the articles is displayed in the “Intelligent Process Lifecycle of Active Cyber Defenders” poster [ 1 ]. The poster showcases the main cyber defence disciplines and how, if false-positive events are classified in a systematic manner for each service, this information can afterwards be used to identify improvement areas. It focuses on false positives, error states, and common operation problems that occur when identifying and assessing vulnerabilities, as well as problems that happen when the security operations centre (SOC) tries to add a log source for continuous monitoring. For all these problems it also includes suggestions on how to solve or document them if they cannot be solved. We also demonstrate how to map these practical SOC outcome failures into clear risk management categories. That mapping can be used to optimize workflows, improve strategic cyber risk management, as well as deliver valuable metrics.

Shift Happens: Human Factors Considerations for Handoffs in Cyber-Security Operations Centers

Cybersecurity breaches have consequences not only at a technical level, but also at economic, legal, individual levels. Organizations depend heavily on the internet to conduct daily operations and activities. As cyber threats increase with frequency and severity, organizations and the cybersecurity experts they employ are facing an uphill battle. To our knowledge, very little research has been done to investigate the handoff processes that exist in Security Operations Centers (SOCs). Researchers and practitioners within the cybersecurity community would benefit from a better understanding of how handoff mechanisms influence SOC team processes and performance. To help attain this goal, this paper aims to explore handoff processes within other domains and illuminate what aspects of handoffs may be extended to SOCs and in what ways handoffs performed in SOCs may need special consideration.

Assessing the Practical Cybersecurity Skills Gained Through Criminal Justice Academic Programs to Benefit Security Operations Centers (SOCs)

Assessing the Practical Cybersecurity Skills Gained Through Criminal Justice Academic Programs to Benefit Security Operations Centers (SOCs)