Analyze How AI Improves Incident Response Time, Alert Prioritization, and Analyst Productivity in SOC Environments

This research paper investigates ways in which Artificial Intelligence would be able to positively affect the speed of incident response, alert prioritization, and analyst productivity at Security Operations Centers by analyzing the information extracted from network traffic data. This research paper uses the quantitative experiment approach, using a public dataset with normal network traffic as well as various cyberattack classes. The study looks into aspects such as class distribution, feature behavior, and risk-based alert prioritization for insights into how Artificial Intelligence could contribute to security operations. The class distribution analysis proves that the dataset is highly unbalanced, as Recon and Scanning classes appear quite often, while other attacks are represented considerably less often. The results for feature behavior demonstrate that packet-based patterns may assist with the differentiation between normal traffic and potentially malicious one. The results of the alert prioritization prove that the highest priority alerts should focus on Recon and Scanning.