AI-assisted Recommendation System for False Positive Reduction at Security Operations Centers

Security Operations Centers (SOCs) are responsible for detection and review of malicious interactions. The SOC issues tickets for interactions that are considered suspicious or threatening. These tickets are then inspected by analysts for approval. For sake of safety, this ticketing system often issues too many “false positives”, i.e., it alerts for interactions that are not really threatening. While this keeps the security level high, it can cause analyst fatigue due to high volume of unnecessary ticket reviews. This project aims to develop an AI-assisted system to refine detection mechanisms at SOCs and reduce the issue of unnecessary alerts. This can contribute significantly in enhancing SOC efficiency by both decreasing the number of false positives and reducing the number of reports being processed by the analyst in a certain time period.

Faculty Supervisor:

Ali Bereyhi

Student:

Partner:

GlassHouse Systems

Discipline:

Engineering

Sector:

Manufacturing; Professional, scientific and technical services

University:

University of Toronto

Program: