Improving and Scaling Security Operations Automation and Orchestration using Predictive Machine Learning

安全运营中心（soc）是打击和确保各种规模的组织应对网络攻击的必要平台。尽管soc很受欢迎，但由于每天观察到的IT基础设施和安全数据和事件的数量、速度和种类的增长，soc面临着越来越多的挑战和压力。由于当前技术解决方案（例如入侵检测系统（IDS）和安全信息与事件管理（SIEM））的混合性能，过度依赖人类安全分析师对事件的手动分析。这造成了大量的积压，并大大减慢了关键安全事件的解决速度。拟议的国际合作的目的是开发下一代安全自动化平台，以提高SOC工作流程和底层流程和任务的有效性和效率。拟议的合作将通过加强对数字资产和关键基础设施的保护以及提高其网络安全行业的竞争力，使加拿大和美国受益。

Security Operation Centers (SOCs) are essential platforms in combating and ensuring the readiness of organizations of all size against cyberattacks. Despite their popularity, SOCs are facing increasing challenges and pressure due to the growing volume, velocity and variety of the IT infrastructure and security data and events observed daily. Due to the mixed performance of current technological solutions, e.g., intrusion detection system (IDS) and security information and event management (SIEM), there is an over-reliance on manual analysis of the events by human security analysts. This creates huge backlogs and slows down considerably the resolution of critical security events. The purpose of the proposed international collaboration is to develop the next generation security automation platform that will increase the effectiveness and efficiency of the SOC workflow and underlying processes and tasks. The proposed collaboration will benefit Canada and the USA by strengthening the protection of digital assets and critical infrastructure and by increasing the competitiveness of their cybersecurity industry.