Jul 2026· International Journal of Advanced Research in Science, Communication and Technology· 0 citations
TL;DR
An AI-driven Security Orchestration, Automation and Response (SOAR) platform that involves: secure authentication, central monitoring, machine learning-based anomaly detection, Groq AI-driven incident analysis, threat intelligence enhancement, n8n workflow automation, AI chatbot, and automatic reporting is focused on.
Abstract
Increasing numbers of cyberattacks led to increasing workload for Security Operations Centers (SOCs). SOC analysts are inundated with hundreds and thousands of alerts from SIEM, IDS/IPS, EDR, firewalls, and cloud/endpoint security systems. Manual investigation leads to alert fatigue, slow responses, and inconsistencies. This paper will focus on an AI-driven Security Orchestration, Automation and Response (SOAR) platform that involves: secure authentication, central monitoring, machine learning-based anomaly detection, Groq AI-driven incident analysis, threat intelligence enhancement, n8n workflow automation, AI chatbot, and automatic reporting. The unified platform increases efficiency, drastically reduce human effort to repetitive work, quick incident response times, enhances the quality of investigations, and provides a comprehensive view of an organizations security posture. The platform is also modular to further integrate with cloud security, SIEM, EDR, malware analysis and predictive analyses
In light of the increased cyber-attacks and complex nature of IT infrastructure today, traditional monitoring systems for security have been identified to be slow and ineffective. Security Operation Centers (SOCs) still employ manual log analysis which causes delays in detecting threats and responding to them. In order to solve this problem, this paper presents the design of an Autonomous Incident Triage and Response Agent (AITRA). The proposed system is an easy and affordable solution which will be based on the idea behind SOAR technology. The proposed system seeks to automate the whole incident management lifecycle by carrying out tasks including log ingestion, event analysis, incident detection, and recommendation of responses. It receives data from sources such as system logs and authentication logs then analyzes them using rule-based analysis methods in order to detect suspicious activities such as failed login attempts, invalid access to the system by users, and escalation of privileges. A decision tree classifier machine learning algorithm is applied in order to categorize behaviors exhibited by the system and enhance detection capabilities. Detected incidents are recorded in a MariaDB database. Some of these responses include blocking IP addresses, suspending suspicious accounts, and informing the administrator. A user-friendly web-based interface that uses React and Flask technologies to help the user perform log upload, incident analysis, and receive appropriate responses is made possible by this software. Experimental evaluation results indicate that this new system makes more efficient use of time and effort than traditional methods and therefore provides better results. This is an implementation of a SOAR system in its miniature version which has the potential for further developments in future.
Dharshan Delwin D, Brindha D, Salaja Silas· 2026 7th International Confe...· 0 citations
A cybersecurity architecture oriented toward fraud prevention in a service sector company in Lima, Peru, whose design is grounded in the documentary analysis of 385 technical incident records is proposed, forming a defense-in-depth capable of reducing residual exposure and sustaining a robust anti-fraud response in digitalized administrative environments.
Enrique Castellares Cuya, José Rengifo Espinal· International Journal of Com...· 0 citations
Security Operations Centers (SOCs) increasingly rely on Security Orchestration, Automation, and Response (SOAR) platforms to manage high-volume alerts, enrich telemetry, execute playbooks, and shorten incident-response cycles. However, many deployed SOAR systems remain rule dominated: actions are triggered by static if-then playbooks, threshold scores, and analyst-defined routing logic. Such deterministic automation is auditable and operationally useful for known, repetitive events, but it becomes brittle when adversary behavior shifts, telemetry quality varies, alert streams are noisy, assets have unequal business criticality, and compliance constraints differ across response contexts. This paper proposes an Intelligent Security Operations Automation Algorithm (ISOAA) for AI-enabled SOAR. The algorithm integrates probabilistic alert risk scoring, event-graph representation, constrained response optimization, governance-risk-compliance (GRC) gating, human-in-the-loop validation, and feedback-based policy improvement. The mathematical core models each alert as a feature-bearing security object, transforms heterogeneous telemetry into a state representation, estimates actionable incident probability, and selects response actions by maximizing expected security utility subject to operational cost, false-positive loss, and compliance penalty. A rule-based SOAR baseline, an ML-assisted triage baseline, and a reinforcement-learning cyber-response baseline are used for comparative analysis. Controlled benchmark results indicate that ISOAA achieves lower mean time to detect, lower mean time to respond, higher containment success, improved precision and recall, reduced false-positive automation, and lower compliance-breach rate than rule-based SOAR. The paper contributes a defensible mathematical architecture for intelligent SOC automation and offers practical deployment recommendations for risk-aware, auditable, and GRC-constrained response orchestration.
Ikenna Mbuko, O. Ijiga, L. Enyejo· International Journal of Eng...· 0 citations
The findings suggest that combining open-source SIEM, workflow automation, and LLM-based reasoning with human supervision offers a practical, low-cost, and reliable approach for strengthening incident response capability in resource-constrained environments.
face of these evolving
dangers. It argues that while compliance-based frameworks provide a necessary governance foundation, they are insufficient
without the integration of proactive strategies like Threat Hunting and Threat Intelligence. In this paper, we present the
Integrated Threat Hunting and Security Orchestration, Automation and Response (SOAR) Automation Workflow (THSAW)
highlighting the necessity of shifting from a reactive "alert-driven" posture to a proactive "hunt-driven" methodology to
ensure organizational resilience. Using a design science paradigm, we describe the solution design rationale and artifact
development. The proactive approach can be used to develop the offensive security-aware environment for organizations to
uncover advanced attack mechanisms and test their ability for attack detection. Experimental results demonstrate the
workflow's effectiveness in autonomous threat detection, behavioral analysis, and automated incident response.
Austin Oguejiofor Amaechi, Ekangwo Hernadez Ebolo, Kum Bertrand Kum et al.· International Journal of Inn...· 0 citations
Cyberattacks are becoming more frequent and sophisticated, and traditional antivirus software is often too slow or ineffective to detect and prevent new threats. Many security setups today still rely on human intervention. The delay this creates gives attackers a window to do serious damage. This shows how important it is to have a system that can detect and neutralize threats automatically, without waiting for human intervention. This paper presents AEGIES-AUTO, an autonomous security system capable of detecting and eliminating cyber threats in real time without any human involvement. The system operates in real time, monitoring all active processes and network connections on a host machine, and responds instantly when it detects suspicious behaviour, such as a reverse shell, a malicious process, or unusual port activity. Its response sequence terminates the offending process, blocks the associated ports, generates a forensic backup of the threat data for subsequent review, captures a screenshot as evidence, and sends instant alerts via email, desktop notifications, and voice messages, all within seconds of detection. AEGIES-AUTO is implemented in Python and provides a web-based dashboard showing live security metrics, threat history, and overall system health. It also features whitelist management to prevent false positives, a quarantine directory for isolating suspicious files and structured report generation for organised documentation. What makes AEGIES-AUTO different from traditional tools is the combination of speed and true autonomy: it doesn't wait for a human response, so threats are neutralised immediately upon detection. The system is realistic security for students, individual users and small organisations that cannot justify the cost of commercial security subscriptions, being lightweight, easy to deploy and free of licensing costs. In summary, AEGIES-AUTO demonstrates that effective, autonomous, real-time threat response can be achieved without the overhead normally associated with enterprise-grade security platforms
Surya Narayana Reddy B G, Manoj Kumar L, Prof. Thejaswini M N· International Journal of Adv...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
