The Next Gen Security Operation Center

Abstract

Due to the evolving Cyber threat landscape, Cyber criminals have found new and ingenious ways of breaching defenses in networks. Due to the sheer destruction these threat actors can cause to an organization, most modern-day organizations have focused their attention towards protecting their critical infrastructure and sensitive information through multiple methods. The main defense against both internal and external threats to an organization has been the implementation of the Security Operations Center (SOC) which is responsible for monitoring, analyzing and mitigating incoming threats. At the heart of the Security Operations Center, lies the Security Information and Event Management system (SIEM) which is utilized by SOC analysts as the centralized point where all security notifications from various security technologies including firewalls, IPS/IDS and Anti-Virus logs are collected and visualized. The effective operation of SOC in an organization is dependent on how well the SIEM filters log events and generates actual alerts. Here lies the major problem faced by SOC analysts in detecting threats. If proper alert correlation is not accomplished, analysts would have to deal with too much alert noise due to a high false positive count. This would ultimately cause analysts to miss critical security incidents, thus causing severe implications to the organization's security. The performance of a SIEM can be enhanced through adding various functionalities such as Threat Hunting, Threat Intelligence and malware identification and prevention in order to reduce false positive alarms, threat framework and machine learning which would increase the accuracy and efficiency of the overall Security Operations process of an organization. Even though many products which provide these additional functionalities exist in the current market, they can be too expensive for smaller scale organizations to handle. Our aim is to make security operations deliverable to any organization regardless of the size and scale without any financial implications and enhance its functionalities with the aid of Advanced Machine Learning Techniques.