Cyber SOC Enhancement: Elevating Recurring Ticket Investigations and Client-Centric KPIs

In the modern era of increased digital and online operations, Security Operation Centers (SOCs) serve as frontline warriors, diligently monitoring and responding to a myriad of cyber security incidents. The SOC team at the project partner’s organization routinely investigates and responds to similar security incidents faced by clients. This project focuses on improving the quality and efficiency of SOC ticket investigation capabilities by developing a machine learning approach to automatically identify and manage repetitive security alerts reported to their incident ticketing system. A secondary goal of the project is to establish a process for identifying and evolving key performance indicators (KPIs) or metrics for various SOC clients. The ability to implement tailored KPIs for each client will help provide the partner with a competitive edge for better defending clients against cyber threats. Through this research, the project team seeks to improve the effectiveness of the partner company’s SOC in defending its clients against malicious cyberattacks.

Faculty Supervisor:

Rozita Dara

Student:

Partner:

GlassHouse Systems

Discipline:

Computer science

Sector:

Manufacturing; Professional, scientific and technical services

University:

University of Guelph

Program: