USER-CENTRIC MACHINE LEARNING FRAMEWORK FOR CYBER SECURITY OPERATIONS CENTER

Abstract

The rapid expansion of digital technologies, cloud computing, and online communication platforms has significantly increased the volume and complexity of cyber threats faced by organizations worldwide. Security Operations Centers (SOCs) are responsible for continuously monitoring network activities, analyzing system logs, and identifying suspicious behavior to protect organizational assets from cyberattacks. Most modern organizations rely on Security Information and Event Management (SIEM) systems to gather and correlate security events generated from multiple devices such as firewalls, servers, intrusion detection systems, and endpoints. Although SIEM platforms are capable of generating alerts for possible threats, they also produce a very large number of false-positive alerts. This excessive alert generation creates a major burden on SOC analysts, making it difficult to prioritize real threats effectively. As a result, critical attacks may remain undetected or may be identified too late, causing severe damage to organizational infrastructure and sensitive data.