Integrating Artificial Intelligence into Security Operation Centres
摘要
Security Operation Centres (SOC) are a cyber security management solution typically utilised in conjunction with Security Information and Event Management (SIEM) tool suites in order to effectively respond to security threats. Due to the rising prevalence of cyber security events, SOC analysts face significant noise within their day-to-day operations risking alert fatigue which may impact their ability to respond effectively to threats. The embedding of Artificial Intelligence (AI) based tooling offers a synergistic solution to this contemporary challenge as AI can triage data at scale enabling analysts greater ease in distinguishing incidents from events. This research project seeks to ascertain what opportunities AI presents within traditional SOCs, as well as the challenges organisations may face in adoption. This will be achieved through the analysis of contemporary research in this field, focusing on topics associated with SIEM technologies, Human-AI Teaming (HAT), and positive identification, in the form of a literature review. Additionally, this research project seeks to ascertain how differing levels of AI integration impact the value of AI integration within SOCs.