AI-assisted Recommendation System for False Positive Reduction at Security Operations Centers
Security Operations Centers (SOCs) are responsible for detection and review of malicious interactions. The SOC issues tickets for interactions that are considered suspicious or threatening. These tickets are then inspected by analysts for approval. For sake of safety, this ticketing system often issues too many “false positives”, i.e., it alerts for interactions that are not really threatening. While this keeps the security level high, it can cause analyst fatigue due to high volume of unnecessary ticket reviews. This project aims to develop an AI-assisted system to refine detection mechanisms at SOCs and reduce the issue of unnecessary alerts. This can contribute significantly in enhancing SOC efficiency by both decreasing the number of false positives and reducing the number of reports being processed by the analyst in a certain time period.
View Full Project DescriptionAli Bereyhi
GlassHouse Systems
Engineering
Manufacturing; Professional, scientific and technical services
University of Toronto
Accelerate
