Cyber security operations centre ML framework for the needs of the users

Abstract

To ensure an organization's cyber security, a SIEM (Security Information and Event Management) system is generally in place to standardize security events from multiple preventative technologies and signal alarms. Security operation center (SOC) analysts analyze the alerts to determine whether or not the threat is genuine. However, the sheer volume of warnings is deafening, with the vast majority of them being false positives that strain the SOC's ability to process them all. As a result, harmful assaults and infected hosts may go undetected. SOC analysts' productivity can be improved by reducing the number of false positives in their reports using machine learning. In this study, we create a cyber security operation center user-centric machine learning framework in a real-world corporate setting. To develop a successful machine learning system, we cover the usual data sources in SOC, their workflow, and how to use and analyze these data sets.