The Next Generation Cognitive Security Operations Center: Adaptive Analytic Lambda Architecture for Efficient Defense against Adversarial Attacks

Abstract

A Security Operations Center (SOC) is a central technical level unit responsible for monitoring, analyzing, assessing, and defending an organization’s security posture on an ongoing basis. The SOC staff works closely with incident response teams, security analysts, network engineers and organization managers using sophisticated data processing technologies such as security analytics, threat intelligence, and asset criticality to ensure security issues are detected, analyzed and finally addressed quickly. Those techniques are part of a reactive security strategy because they rely on the human factor, experience and the judgment of security experts, using supplementary technology to evaluate the risk impact and minimize the attack surface. This study suggests an active security strategy that adopts a vigorous method including ingenuity, data analysis, processing and decision-making support to face various cyber hazards. Specifically, the paper introduces a novel intelligence driven cognitive computing SOC that is based exclusively on progressive fully automatic procedures. The proposed λ-Architecture Network Flow Forensics Framework (λ-ΝF3) is an efficient cybersecurity defense framework against adversarial attacks. It implements the Lambda machine learning architecture that can analyze a mixture of batch and streaming data, using two accurate novel computational intelligence algorithms. Specifically, it uses an Extreme Learning Machine neural network with Gaussian Radial Basis Function kernel (ELM/GRBFk) for the batch data analysis and a Self-Adjusting Memory k-Nearest Neighbors classifier (SAM/k-NN) to examine patterns from real-time streams. It is a forensics tool for big data that can enhance the automate defense strategies of SOCs to effectively respond to the threats their environments face.

Leveraging Computational Intelligence Techniques for Defensive Deception: A Review, Recent Advances, Open Problems and Future Directions

“…Deception-based defenses are potent weapons that have been proven to work in various domains. Their efficacy is based on the fact that they are programmed to exploit key biases to appear realistic but misleading substitutes to the hidden reality [ 79 , 80 , 81 , 82 , 83 , 84 , 85 , 86 , 87 , 88 , 89 , 90 , 91 , 92 , 93 , 94 , 95 , 96 , 97 , 98 , 99 , 100 , 101 , 102 , 103 , 104 , 105 , 106 , 107 , 108 ]. As a result, one will require a thorough understanding of both offensive and defensive trickery to implement a perfect Deception strategy.…”

SOC Critical Path: A Defensive Kill Chain Model

“…We consider visualization as not a key tactic for a SOC, but a technique for human analysis. Especially when dealing with big data environments, situational awareness in any of its forms is an important decision-support mechanism [43] [44] for Computer Network Defense. From an architectural point of view, the layers of a SOC have also been analyzed in works such as [35] or [5].…”

Understanding and Assessment of Mission-Centric Key Cyber Terrains for joint Military Operations

“…As Jajodia et al stated in [27]: to protect critical network infrastructures and missions, we must understand not only the vulnerabilities of each individual system, but also their inter-dependencies and how they support missions, which gains difficulty when operating on emerging technological ecosystems [28,29], combining the perception of both insider and outsider threats [30] or facing adversarial evasion tactics [31,32] . At the same time, they proposed a framework to obtain mission-centric SA (Cauldron) combining data fusion, network paths of vulnerabilities, alert correlation, mission impact analysis and recommended reactive/proactive mitigation actions [33,34].…”