Improving and Scaling Security Operations Automation and Orchestration using Predictive Machine Learning

使用预测机器学习改进和扩展安全运营自动化和编排

• 批准号: 580634-2022
• 负责人: Traore, IssaI
• 金额: $ 1.82万
• 依托单位: University of Victoria
• 依托单位国家: 加拿大
• 项目类别: Alliance Grants
• 财政年份: 2022
• 资助国家: 加拿大
• 起止时间: 2022-01-01 至 2023-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=751976
• 关键词: Improving; Scaling; Security; Operations; Automation

Security Operation Centers (SOCs) are essential platforms in combating and ensuring the readiness of organizations of all size against cyberattacks. Despite their popularity, SOCs are facing increasing challenges and pressure due to the growing volume, velocity and variety of the IT infrastructure and security data and events observed daily. Due to the mixed performance of current technological solutions, e.g., intrusion detection system (IDS) and security information and event management (SIEM), there is an over-reliance on manual analysis of the events by human security analysts. This creates huge backlogs and slows down considerably the resolution of critical security events. The purpose of the proposed international collaboration is to develop the next generation security automation platform that will increase the effectiveness and efficiency of the SOC workflow and underlying processes and tasks. The proposed collaboration will benefit Canada and the USA by strengthening the protection of digital assets and critical infrastructure and by increasing the competitiveness of their cybersecurity industry.

安全运营中心（SOC）是打击和确保各种规模的组织准备好应对网络攻击的重要平台。 尽管SOC很受欢迎，但由于IT基础设施的数量、速度和种类以及每天观察到的安全数据和事件不断增长，SOC面临着越来越多的挑战和压力。由于当前技术解决方案的混合性能，例如，入侵检测系统（IDS）和安全信息和事件管理（SIEM），过度依赖人类安全分析人员对事件的手动分析。这造成了巨大的积压，大大减缓了关键安全事件的解决速度。拟议的国际合作的目的是开发下一代安全自动化平台，以提高SOC工作流程和底层流程和任务的有效性和效率。 拟议的合作将通过加强对数字资产和关键基础设施的保护以及提高其网络安全行业的竞争力而使加拿大和美国受益。