Aug 2026· Journal of King Saud University: Computer and Information Sciences· Vol 38· 0 citations· 55 references
TL;DR
An end-to-end SOC priority awareness framework is implemented and evaluated against commercial and open-source SOC platforms, indicating that the framework can support earlier triage, more reliable alert prioritization, and more efficient SOC threat response under high-noise operational conditions.
Abstract
The Security Operations Center (SOC) is a key operational platform in modern enterprise cybersecurity architectures, where alert monitoring, threat detection, and incident response must be performed under high-volume and high-noise conditions. Detection is increasingly challenged by cyberattacks with growing complexity, novelty, coordination, and stealth, resulting in massive false positives, difficulty in identifying high-risk alerts, analyst fatigue, and delayed response. This study proposes an intelligent priority awareness method for SOC alert data. First, a hierarchical alert noise reduction method is designed by combining Fast Fourier Transform-Pearson Correlation Coefficient (FFT-PCC) filtering with BERT-assisted multi-agent evidence orchestration. To prevent periodic but genuinely high-risk alerts from being mistakenly removed, the FFT-PCC module is constrained by a conservative risk-gated filtering rule that forwards any alert with threat-intelligence, asset-criticality, or attack-stage evidence to deeper analysis. On the labeled benchmark, the method achieves an AUC of 0.973, an accuracy of 0.9467, a precision of 0.923, a recall of 0.897, and an F1-score of 0.910 for false-positive alert identification. In a separate production-stream usability evaluation, it achieves a 72.0% alert noise reduction rate. Second, a dynamic risk scoring system is constructed by integrating cybersecurity knowledge graphs, asset-vulnerability association graphs, formal semantic integrity verification, and Analytic Hierarchy Process (AHP)-based weighting. Finally, an end-to-end SOC priority awareness framework is implemented and evaluated against commercial and open-source SOC platforms. The framework reduces mean threat response time by 45.2%, increases alert processing throughput by 103%, and lowers analyst cognitive load by 37%. The results indicate that the framework can support earlier triage, more reliable alert prioritization, and more efficient SOC threat response under high-noise operational conditions.
Security operations centers (SOCs) face large numbers of false alerts, making detection of cyberattacks difficult under typical resource constraints. Risk-based alerting (RBA) has been proposed as a means to reduce false alerts and has reportedly succeeded in doing so in various enterprise deployments. However, RBA has not been comprehensively evaluated until now, leaving implementation mostly guesswork based on anecdotal evidence. In this paper, we present the first systematic evaluation of RBA. To this end, we reformulate it as a continuous alert prioritization problem rather than a binary decision problem (i.e., whether an alerting threshold is exceeded), allowing us to evaluate performance across all possible thresholds and thus model SOCs of varying sizes and alert volumes. We distill five fundamental risk hypotheses, formalize them as independently parametrizable modules, and implement them in our novel experimentation suite CATS. We thoroughly assess the hypotheses across eight diverse alert datasets, six of which we created or extended to make such an evaluation possible. Our results show that certain combinations of hypotheses achieve a remarkable alert prioritization performance (AUROC $\mu=0.92$, $\sigma=0.09$ across the eight datasets), outperforming a straightforward prioritization by alert severity level (AUROC $\mu=0.72$, $\sigma=0.21$). We conclude that RBA can substantially reduce the number of false alerts that analysts have to review and thus has the potential to mitigate cybersecurity alert fatigue. In addition, it serves as a strong baseline for more complex, resource-intensive alert triage approaches (e.g., based on large language models).
Rafael Uetz, Philipp Bönninghausen, Louis Hackländer-Jansen et al.· 0 citations
As the interconnection of digital infrastructures grows at a fast pace, businesses are facing ever-evolving cyber threats. Efficient detection of intrusions is required due to the growing complexity of cyber threats. Classical Network Intrusion Detection Systems (NIDS) have a good capability to detect intrusion events based on certain signatures; nevertheless, they produce lots of unfiltered alerts, increasing the workloads of SOC analysts. In this regard, this research suggests a NIDS with a built-in capability of alert generation and priority assignment based on the Exploit Prediction Scoring System (EPSS). The suggested NIDS can perform real-time monitoring of the network and offline PCAP file analysis for discovering such intrusion events as port scans, brute force, unauthorized access attempts, and protocols misuses. Generated alerts will be sent through an HTTPS connection and will be supplemented with CVE-related vulnerability information. The EPSS scores will be employed to determine actual exploitability of identified vulnerabilities and assign alerts to particular priority categories. Besides, the introduced method includes explainable alert generation and SOC-style visualizing tool. Experiment shows that such NIDS will help to optimize the process of alert management and provide a better user experience for SOC analysts.
R. K, V. V, Ajay Poojith S R et al.· 2026 International Conferenc...· 0 citations
This paper proposes GRAL, which is an AI-driven framework that combines graph neural networks (GNN) for cross-asset temporal alert correlation, retrieval-augmented generation (RAG) for dynamic threat intelligence enrichment, and large language models (LLM) for semantic reasoning and verdict generation.
Deng Zhang, Juan Wang, Hanjun Gao et al.· Symmetry· 0 citations
An AI-driven Security Orchestration, Automation and Response (SOAR) platform that involves: secure authentication, central monitoring, machine learning-based anomaly detection, Groq AI-driven incident analysis, threat intelligence enhancement, n8n workflow automation, AI chatbot, and automatic reporting is focused on.
Bhumika A R, Jhanavi H N, Prof. Thejaswini M N· International Journal of Adv...· 0 citations
An attack taxonomy of the proposed system is presented, mimicking real-world attacks such as Denial of Service, Man-in-the-Middle, and insider attacks, to show how the system can detect, counter, and prevent risks successfully and efficiently in the overall network.
Muazu Abdulwakil Auma, Yang Li· International Journal of Adv...· 0 citations
A GenAI-driven adaptive cybersecurity mesh architecture designed for real-time threat detection in distributed intelligent communication environments and demonstrates improved detection accuracy, reduced false positives, and lower response latency compared to baseline signature-based and centralised ML-based IDS models.
