The continuous integration of automated tools into security operation centers (SOCs)
increases the volume of alerts for security analysts. This amplifies the risk of automation bias …

Since the introduction of Security Operations Centers (SOCs) around 15 years ago, their
importance has grown significantly, especially over the last five years. This is mainly due to …

In this work, we focus on the prevalence of False Positive (FP) alarms produced by security
tools, and Security Operation Centers (SOCs) practitioners' perception of their quality. In an …

Traditionally, network and security operation center teams have worked in silos despite
commonalities. The network operating center (NOC) team is to provide operationality and …

Security monitoring systems detect potentially malicious activities in IT infrastructures, by
either looking for known signatures or for anomalous behaviors. Security operators …

Commercial threat intelligence is thought to provide unmatched coverage on attacker
behavior, but it is out of reach for many organizations due to its hefty price tag. This paper …

The very raison d'être of cyber threat intelligence (CTI) is to provide meaningful knowledge
about cyber security threats. The exchange and collaborative generation of CTI by the …

The threat of cyber attacks is a growing concern across the world, leading to an increasing
need for sophisticated cyber defense techniques. Attackers often rely on direct observation …

As an emerging security paradigm, machine learning (ML) based malicious traffic detection
is an essential part of automatic defense against network attacks. Powered by dedicated …

Analysts who work in a Security Operations Centre (SOC) play an essential role in
supporting businesses to protect their computer networks against cyber attacks. To manage …