Improving and Scaling Security Operations Automation and Orchestration using Predictive Machine Learning

点击翻译按钮获取中文摘要

Security Operation Centers (SOCs) are essential platforms in combating and ensuring the readiness of organizations of all size against cyberattacks. Despite their popularity, SOCs are facing increasing challenges and pressure due to the growing volume, velocity and variety of the IT infrastructure and security data and events observed daily. Due to the mixed performance of current technological solutions, e.g., intrusion detection system (IDS) and security information and event management (SIEM), there is an over-reliance on manual analysis of the events by human security analysts. This creates huge backlogs and slows down considerably the resolution of critical security events. The purpose of the proposed international collaboration is to develop the next generation security automation platform that will increase the effectiveness and efficiency of the SOC workflow and underlying processes and tasks. The proposed collaboration will benefit Canada and the USA by strengthening the protection of digital assets and critical infrastructure and by increasing the competitiveness of their cybersecurity industry.