Faced with current cyber threats, traditional SOCs are often overloaded and reactive. This article proposes an adaptive scoring model to move from a reactive logic to a proactive logic in order to anticipate network attacks. Each network event is analyzed in real time according to its frequency, its risk type, and according to the reputation of the IP address of the event, which allows having a score ranging from zero to one. A Python prototype was developed to simulate a log stream and calculate the scores. The results show that the model can prioritize important alerts in order to reduce the overload for analysts. This proof of concept proves the feasibility of an intelligent SOC capable of proactively spreading emerging threats.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Towards an Intelligent SOC: Proof of Concept of an Adaptive Scoring Model for Proactive Network Attack Detection

  • Fatima Benettaj,
  • Meriem Mandar

摘要

Faced with current cyber threats, traditional SOCs are often overloaded and reactive. This article proposes an adaptive scoring model to move from a reactive logic to a proactive logic in order to anticipate network attacks. Each network event is analyzed in real time according to its frequency, its risk type, and according to the reputation of the IP address of the event, which allows having a score ranging from zero to one. A Python prototype was developed to simulate a log stream and calculate the scores. The results show that the model can prioritize important alerts in order to reduce the overload for analysts. This proof of concept proves the feasibility of an intelligent SOC capable of proactively spreading emerging threats.