Richer situational awareness does not always improve SOC alert validation
Original title: Integrating Perception, Comprehension, and Projection for Alert Validation: A Unified Cyber Situational Awareness Framework
On Cadets and Theia, comprehension-level context lifts Recall@5 by as much as 75 points versus Max. CSG.
The paper evaluates perception-, comprehension- and projection-level cyber situational awareness for validating SOC alerts. Using Captain and Kairos, it treats validation as positive-unlabelled multi-instance learning over behavioural hypotheses on the DARPA TC dataset. Comprehension-level causal context improves recall and ranking versus Queue and Max. CSG on Cadets and Theia. Projection can help further, but gains depend on the horizon.
- PU-MIL gains up to 28.6 and 75 Recall@5 points versus the two baselines.
- Mean positive rank falls 24.6% on Cadets and 86.8% on Theia.
- A 40-minute horizon cuts Theia's mean positive rank from 22.0 to 8.5.
- Organizations
- DARPA
From the original article
1 min read at arxiv.orgSecurity Operation Centres (SOCs) must validate large volumes of alerts with limited analyst resources, yet alerts often lack sufficient context to determine whether suspicious activity is attack related.
By Navodika Karunasingha · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.