Yapay Zekâ Destekli SOC Alarm Önceliklendirme Tasarımı Üzerine Bir Araştırma

Abstract

Günümüzde artan veri hacmi ve tehdit çeşitliliği, siber güvenlik operasyonlarında daha akıllı ve bütüncül yaklaşımları zorunlu kılmaktadır. Literatürde alarm önceliklendirme çoğunlukla severity alanına dayalı bir sıralama olarak ele alınmaktadır. Çalışma kapsamında, alarm önceliklendirme iş etkisi, varlık kritikliği seviyesi ve maruziyet bağlamını birleştiren denetlenebilir bir karar destek problemi olarak ele alınmaktadır. Araştırma, Tasarım Bilimi Araştırması (Design Science Research, DSR) paradigmasıyla yapılandırılmıştır. Önerilen karar destek tasarımı üç işlevsel katmandan oluşmaktadır. Birinci katman bağlam zenginleştirme (varlık kritikliği, zafiyet/yama durumu, ATT&CK etiketleme), ikinci katman açıklanabilir bileşen temelli skorlama, üçüncü katman ise insan-döngüde geri bildirim mekanizmasıdır. Öncelik skorunu eskalasyon olasılığına dönüştüren “kalibrasyon katmanı”, kara kutu bir sınıflandırıcı yerine yorumlanabilir bir lojistik regresyon biçiminde tasarlanmakta ve yalnızca kavramsal düzeyde önerilmekte; söz konusu katman çalışma kapsamında hiçbir veri üzerinde eğitilmemektedir. Sentetik ve anonimleştirmeye uygun dört senaryo üzerinden yapılan gösterim, aynı veya benzer ham şiddet etiketine sahip alarmların varlık kritikliği ve iş etkisi, tehdit bağlamı, korelasyon ve maruziyet bileşenleri kullanılarak farklı öncelik skorlarına ayrıştırılabildiğini ortaya koymaktadır. Triyaj süresi, yanlış pozitif yükü ve kritik olay görünürlüğü üzerindeki operasyonel etkiler ise bu çalışma kapsamında ölçülmemiş olup gerçek kurum verileriyle doğrulanması gereken beklenen faydalar olarak tanımlanmaktadır. Sonuç olarak önerilen tasarım, mevcut SIEM kural setlerini kökten değiştirmeden devreye alınabilen, gerekçe üretimi, versiyonlama ve denetim izi üzerinden hesap verebilirliği güçlendiren yönetilebilir bir SOC önceliklendirme yaklaşımı önermektedir.

Keywords

• Yapay zekâ
• SOC
• Alarm önceliklendirme
• Bilgi güvenliği
• Karar destek sistemleri

Supporting Institution

Bu çalışma için herhangi bir kurum veya kuruluş tarafından finansal destek sağlanmamıştır.

Ethical Statement

Bu çalışma, doğrudan insan katılımcılar üzerinde yürütülen bir araştırma, klinik çalışma veya kişisel veri toplamaya dayalı saha uygulaması içermemektedir. Çalışmada gerçek kurum verisi kullanılmamış; kavramsal model geliştirme, literatür temelli değerlendirme ve anonimleştirmeye uygun örnek senaryolar esas alınmıştır. Bu nedenle etik kurul izni gerektiren bir araştırma kapsamında değerlendirilmemektedir. Bilimsel araştırma ve yayın etiği kurallarına uyulmuştur.

Thanks

Teşekkür beyanı bulunmamaktadır.

A Study on Artificial Intelligence-Assisted SOC Alarm Prioritization Design

Abstract

Today’s increasing volume of data and diversity of threats necessitate smarter and more holistic approaches in cybersecurity operations. While the literature often presents alarm prioritization as a ranking based solely on severity, this study addresses it as an auditable decision-support problem that integrates business impact, asset criticality level, and exposure context. The research is structured within the Design Science Research (DSR) paradigm. The proposed decision-support design consists of three functional layers. The first layer involves context enrichment (asset criticality, vulnerability/patch status, ATT&CK tagging), the second layer involves explainable component-based scoring, and the third layer involves a human-in-the-loop feedback mechanism. The “calibration layer” that maps the priority score to an escalation probability is envisaged as an interpretable logistic regression rather than a black-box classifier and is proposed at a conceptual level only; this layer is not trained on any data within the study. A scenario-based illustration using four synthetic and anonymizable cases shows that alerts with the same or similar raw severity labels can be differentiated through asset criticality and business impact, threat context, correlation, and exposure components. Operational effects on triage time, false-positive workload, and critical-alert visibility are not measured within this study and are therefore framed as expected benefits that require validation with real organizational data. In conclusion, the study proposes a manageable SOC prioritization approach that can be implemented without fundamentally altering existing SIEM rule sets, while enhancing accountability through justification generation, versioning, and audit trails.

Keywords

• Artificial intelligence
• SOC
• Alarm prioritization
• Information security
• Decision support systems

Supporting Institution

No financial support was received from any institution or organization for this study.

Ethical Statement

This study does not involve human participants, clinical procedures, or field research based on the collection of personal data. No real institutional data were used; instead, the study is based on conceptual model development, literature-based evaluation, and anonymization-compatible illustrative scenarios. Therefore, the study is not considered to require ethics committee approval. The principles of scientific research and publication ethics were followed.

Thanks

There is no acknowledgement statement.

References

1. Alvarez-Melis, D., & Jaakkola, T. S. (2018). On the robustness of interpretability methods. ICML Workshop on Human Interpretability in Machine Learning (WHI 2018). arXiv. https://doi.org/10.48550/arXiv.1806.08049
2. Baruwal Chhetri, M., Tariq, S., Singh, R., Jalalvand, F., Paris, C., & Nepal, S. (2024). Towards human-AI teaming to mitigate alert fatigue in security operations centres. ACM Transactions on Internet Technology, 24(3), Article 12, 1–22. https://doi.org/10.1145/3670009
3. European Union Agency for Cybersecurity. (2020). How to set up CSIRT and SOC. ENISA. https://www.enisa.europa.eu/publications/how-to-set-up-csirt-and-soc
4. European Union Agency for Cybersecurity. (2024). 2024 report on the state of the cybersecurity in the Union. ENISA. https://www.enisa.europa.eu/publications/2024-report-on-the-state-of-the-cybersecurity-in-the-union
5. Habibzadeh, A., Feyzi, F., & Atani, R. E. (2026). Large language models for security operations centers: A comprehensive survey. Journal of Electrical and Computer Engineering, 2026(1), Article 3383674. https://doi.org/10.1155/jece/3383674
6. Hassan, W. U., Bates, A., & Marino, D. (2020). Tactical provenance analysis for endpoint detection and response systems. In 2020 IEEE Symposium on Security and Privacy (SP) (pp. 1172–1189). IEEE. https://doi.org/10.1109/SP40000.2020.00096
7. International Organization for Standardization & International Electrotechnical Commission. (2022). Information security, cybersecurity and privacy protection — Information security management systems — Requirements (ISO/IEC 27001:2022). ISO. https://www.iso.org/standard/27001
8. Jalalvand, F., Baruwal Chhetri, M., Nepal, S., & Paris, C. (2024). Alert prioritisation in security operations centres: A systematic survey on criteria and methods. ACM Computing Surveys, 57(2), Article 42, 1–36. https://doi.org/10.1145/3695462

9. Jalalvand, F., Baruwal Chhetri, M., Nepal, S., & Paris, C. (2025). Adaptive alert prioritisation in security operations centres via learning to defer with human feedback [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2506.18462
10. Khayat, M., Barka, E., Adel Serhani, M., Sallabi, F., Shuaib, K., & Khater, H. M. (2025). Empowering security operation center with artificial intelligence and machine learning: A systematic literature review. IEEE Access, 13, 19162–19197. https://doi.org/10.1109/ACCESS.2025.3532951
11. Landauer, M., Skopik, F., Wurzenberger, M., & Rauber, A. (2022). Dealing with security alert flooding: Using machine learning for domain-independent alert aggregation. ACM Transactions on Privacy and Security, 25(3), Article 18, 1–36. https://doi.org/10.1145/3510581
12. Liu, J., Zhang, R., Liu, W., Zhang, Y., Gu, D., Tong, M., Wang, X., Xue, J., & Wang, H. (2022). Context2Vector: Accelerating security event triage via context representation learning. Information and Software Technology, 146, Article 106856. https://doi.org/10.1016/j.infsof.2022.106856
13. Lundberg, S. M., & Lee, S.-I. (2017). A unified approach to interpreting model predictions. In Advances in Neural Information Processing Systems 30 (pp. 4765–4774). Curran Associates, Inc. https://proceedings.neurips.cc/paper/2017/hash/8a20a8621978632d76c43dfd28b67767-Abstract.html
14. MITRE. (2024). MITRE ATT&CK knowledge base (Version 16.1). https://attack.mitre.org
15. National Institute of Standards and Technology. (2020). Security and privacy controls for information systems and organizations (NIST Special Publication 800-53, Rev. 5). https://doi.org/10.6028/NIST.SP.800-53r5
16. National Institute of Standards and Technology. (2023). Artificial intelligence risk management framework (AI RMF 1.0). https://doi.org/10.6028/NIST.AI.100-1
17. National Institute of Standards and Technology. (2024). The NIST cybersecurity framework (CSF) 2.0. https://doi.org/10.6028/NIST.CSWP.29
18. Peffers, K., Tuunanen, T., Rothenberger, M. A., & Chatterjee, S. (2007). A design science research methodology for information systems research. Journal of Management Information Systems, 24(3), 45–77. https://doi.org/10.2753/MIS0742-1222240302
19. Pendlebury, F., Pierazzi, F., Jordaney, R., Kinder, J., & Cavallaro, L. (2019). TESSERACT: Eliminating experimental bias in malware classification across space and time. In Proceedings of the 28th USENIX Security Symposium (pp. 729–746). USENIX Association. https://www.usenix.org/conference/usenixsecurity19/presentation/pendlebury
20. Phillips, P. J., Hahn, C. A., Fontana, P. C., Yates, A. N., Greene, K., Broniatowski, D. A., & Przybocki, M. A. (2021). Four principles of explainable artificial intelligence (NISTIR 8312). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.IR.8312
21. Ribeiro, M. T., Singh, S., & Guestrin, C. (2016). “Why should I trust you?”: Explaining the predictions of any classifier. In Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (pp. 1135–1144). ACM. https://doi.org/10.1145/2939672.2939778
22. Saito, T., & Rehmsmeier, M. (2015). The precision-recall plot is more informative than the ROC plot when evaluating binary classifiers on imbalanced datasets. PLOS ONE, 10(3), e0118432. https://doi.org/10.1371/journal.pone.0118432
23. Silva Filho, T., Song, H., Perello-Nieto, M., Santos-Rodriguez, R., Kull, M., & Flach, P. (2023). Classifier calibration: A survey on how to assess and improve predicted class probabilities. Machine Learning, 112(9), 3211–3260. https://doi.org/10.1007/s10994-023-06336-7
24. Srinivas, S., Kirk, B., Zendejas, J., Espino, M., Boskovich, M., Bari, A., Dajani, K., & Alzahrani, N. (2025). AI-augmented SOC: A survey of LLMs and agents for security automation. Journal of Cybersecurity and Privacy, 5(4), Article 95. https://doi.org/10.3390/jcp5040095
25. Tariq, S., Baruwal Chhetri, M., Nepal, S., & Paris, C. (2025). Alert fatigue in security operations centres: Research challenges and opportunities. ACM Computing Surveys, 57(9), Article 224, 1–38. https://doi.org/10.1145/3723158
26. Vielberth, M., Böhm, F., Fichtinger, I., & Pernul, G. (2020). Security operations center: A systematic study and open challenges. IEEE Access, 8, 227756–227779. https://doi.org/10.1109/ACCESS.2020.3045514
27. Wang, X., Yang, X., Liang, X., Zhang, X., Zhang, W., & Gong, X. (2024). Combating alert fatigue with AlertPro: Context-aware alert prioritization using reinforcement learning for multi-step attack detection. Computers & Security, 137, Article 103583. https://doi.org/10.1016/j.cose.2023.103583
28. Wei, B., Tay, Y. S., Liu, H., Pan, J., Luo, K., Zhu, Z., & Jordan, C. (2025). CORTEX: Collaborative LLM agents for high-stakes alert triage [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2510.00311
29. Yilmaz, E., Aslam, J. A., & Robertson, S. (2008). A new rank correlation coefficient for information retrieval. In Proceedings of the 31st Annual International ACM SIGIR Conference (pp. 587–594). ACM. https://doi.org/10.1145/1390334.1390435