Security Operations Centers (SOCs) face significant challenges in processing large volumes of event logs. Traditional log screening methods frequently suffer from high false positive rates (FPR) and struggle to identify subtle, evolving threats such as reconnaissance attacks, which often precede more severe intrusions. This paper introduces a novel Class Imbalance-Aware Event-Based Embedding (CIA-EBE) approach designed to enhance SOC log screening by transforming individual security events into dense vector representations while emphasizing minority-class events. We evaluate the effectiveness of CIA-EBE using a dataset derived from Zeek logs and compare its performance against conventional embedding techniques like Word2Vec and Doc2Vec across multiple classifiers. CIA-EBE achieved 0% FPR and 100% recall with the Support Vector Machine classifier using stratified 5-fold cross-validation. Visualization techniques such as t-distributed Stochastic Neighbor Embedding and hierarchical clustering validated the separation between attack and benign events, demonstrating the robustness of CIA-EBE. This study illustrates the potential of AI-driven log screening approaches to enhance the accuracy and efficiency of SOC operations, equipping analysts with improved tools for early cyber threat detection.

Managing a constant stream of security alerts is challenging for cybersecurity teams. Traditional rule–based systems struggle to distinguish real threats from false alarms, which can overwhelm security teams. A significant issue is the scarcity of actual attacks compared to nonthreats. This paper presents a novel method using machine learning that incorporates the focal loss (FL) function to address such alert dataset imbalances. Our system employs a machine learning model trained on daily security alert data that is frequently updated for faster threat detection. The model learns to identify genuine threats while minimizing false alarms. We use the FL function to tackle dataset imbalance by giving more weight to challenging samples. Experiments on real–world datasets show that our approach outperforms existing methods. The FL function enhances alert prioritization, thereby reducing analyst fatigue. The method achieved a 0% false positive rate and high recall rates, demonstrating its potential for security alert screening. Our proposed method advances cybersecurity by reducing false alarms and enhancing threat detection. It also optimizes security resources and contributes to enhanced robust cybersecurity in our interconnected digital world.

Most packets arriving in the darknet (or network telescope), which is unused IP address space on the Internet, are related to indiscriminate scanning and attack activities. In recent years, the number of indiscriminate scanning attacks observed on the darknet has increased in diversity and quantity. In our earlier study, we proposed a framework called Dark-TRACER that detects anomalies in spatiotemporal pattern synchronization by using darknet data, with the aim being early detection of malware-caused indiscriminate scanning attacks. Although Dark-TRACER has achieved an average of 126.4 days earlier threat detection, we have not been able to determine whether there is a relationship between the early detections and the actual threats. Hence, in this paper, we perform a cross-checking analysis to identify if any information links the detections and the actual threats. As a result, we confirmed the validity of our early threat detection framework by showing, e.g., that more than 60% of unique hosts overlapped in large-scale threats. In addition, we outline four future studies to address the issue that the present Dark-TRACER has many false-positive alerts. Lastly, the darknet data used in our research has been made publicly available.

Today’s network security solutions, such as security information and event management systems, security analytics, and log management tools, tend to generate a large volume of threat alerts. The dynamic nature of threat alerts necessitates regular retraining or model updates for adequate detection performance. Meanwhile, common batch machine-learning-based threat alert analyzers are (i) time-consuming and prone to irregular updates, (ii) require massive alert data storage infrastructure, and (iii) poorly scalable for real-world applications. This paper introduces an online learning scheme for critical threat alert detection to address these challenges. This scheme treats threat alert data as a stream of items passed to the learning model, enforcing a quicker and easier response to emergent threat alerts. Furthermore, adopting a focal loss function in learning can effectively cope with the skewness commonly found in threat alert analysis scenarios. The proposed scheme is evaluated on a benchmark dataset collected in the security operation center of a large-scale enterprise network to identify potentially critical threat alerts. With 99.762% recall and 0.008% false positive rate, the proposed scheme yielded promising results for critical threat alert detection and thus points out an effective way to fight a gainst n etwork i ntrusions a nd s ecurity a lert fatigue.

The extraordinary number of alerts generated by network intrusion detection systems (NIDS) can desensitize security analysts tasked with incident response. Security information and event management systems (SIEMs) perform some rudimentary automation but cannot replicate the decision-making process of a skilled analyst. Machine learning and artificial intelligence (AI) can detect patterns in data with appropriate training. In practice, the majority of the alert data comprises false alerts, and true alerts form only a small proportion. Consequently, a naive engine that classifies all security alerts into the majority class can yield a superficial high accuracy close to 100%. Without any correction for the class imbalance, the false alerts will dominate algorithmic predictions resulting in poor generalization performance. We propose a machine-learning approach to address the class imbalance problem in multi-appliance security alert data and automate the security alert analysis process performed in security operations centers (SOCs). We first used the neighborhood cleaning rule (NCR) to identify and remove ambiguous, noisy, and redundant false alerts. Then, we applied the support vector machine synthetic minority oversampling technique (SVMSMOTE) to generate synthetic training true alerts. Finally, we fit and evaluated the decision tree and random forest classifiers. In the experiments, using alert data from eight security appliances, we demonstrated that the proposed method can significantly reduce the need for manual auditing, decreasing the number of uninspected alerts and achieving a performance of 99.524% in recall.