Retrieval of relevant historical data triage operations in security operation centers

Tao Lin, Chen Zhong, John Yen, Peng Liu

Research output: Chapter in Book/Report/Conference proceedingChapter

Abstract

Triage analysis is a fundamental stage in cyber operations in Security Operations Centers (SOCs). The massive data sources generate great demands on cyber security analysts’ capability of information processing and analytical reasoning. Furthermore, most junior security analysts perform much less efficiently than senior analysts in deciding what data triage operations to perform. To help (junior) analysts perform better, several retrieval methods have been proposed to facilitate data triaging through retrieval of the relevant historical data triage operations of senior security analysts. This paper conducts a review of the existing retrieval methods, including rule-based retrieval and context-based retrieval of data triage operations. It further discusses the new directions in solving the data triage operation retrieval problem.

Original languageEnglish (US)
Title of host publicationLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
PublisherSpringer Verlag
Pages227-243
Number of pages17
DOIs
StatePublished - Jan 1 2018

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume11170 LNCS
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349

Fingerprint

Historical Data
Retrieval
Information Processing
Reasoning

All Science Journal Classification (ASJC) codes

  • Theoretical Computer Science
  • Computer Science(all)

Cite this

Lin, T., Zhong, C., Yen, J., & Liu, P. (2018). Retrieval of relevant historical data triage operations in security operation centers. In Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) (pp. 227-243). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 11170 LNCS). Springer Verlag. https://doi.org/10.1007/978-3-030-04834-1_12
Lin, Tao ; Zhong, Chen ; Yen, John ; Liu, Peng. / Retrieval of relevant historical data triage operations in security operation centers. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics). Springer Verlag, 2018. pp. 227-243 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).
@inbook{961638dd376f4aad8f02e61465d0e0e2,
title = "Retrieval of relevant historical data triage operations in security operation centers",
abstract = "Triage analysis is a fundamental stage in cyber operations in Security Operations Centers (SOCs). The massive data sources generate great demands on cyber security analysts’ capability of information processing and analytical reasoning. Furthermore, most junior security analysts perform much less efficiently than senior analysts in deciding what data triage operations to perform. To help (junior) analysts perform better, several retrieval methods have been proposed to facilitate data triaging through retrieval of the relevant historical data triage operations of senior security analysts. This paper conducts a review of the existing retrieval methods, including rule-based retrieval and context-based retrieval of data triage operations. It further discusses the new directions in solving the data triage operation retrieval problem.",
author = "Tao Lin and Chen Zhong and John Yen and Peng Liu",
year = "2018",
month = "1",
day = "1",
doi = "10.1007/978-3-030-04834-1_12",
language = "English (US)",
series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",
publisher = "Springer Verlag",
pages = "227--243",
booktitle = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",
address = "Germany",

}

Lin, T, Zhong, C, Yen, J & Liu, P 2018, Retrieval of relevant historical data triage operations in security operation centers. in Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics). Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 11170 LNCS, Springer Verlag, pp. 227-243. https://doi.org/10.1007/978-3-030-04834-1_12

Retrieval of relevant historical data triage operations in security operation centers. / Lin, Tao; Zhong, Chen; Yen, John; Liu, Peng.

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics). Springer Verlag, 2018. p. 227-243 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 11170 LNCS).

Research output: Chapter in Book/Report/Conference proceedingChapter

TY - CHAP

T1 - Retrieval of relevant historical data triage operations in security operation centers

AU - Lin, Tao

AU - Zhong, Chen

AU - Yen, John

AU - Liu, Peng

PY - 2018/1/1

Y1 - 2018/1/1

N2 - Triage analysis is a fundamental stage in cyber operations in Security Operations Centers (SOCs). The massive data sources generate great demands on cyber security analysts’ capability of information processing and analytical reasoning. Furthermore, most junior security analysts perform much less efficiently than senior analysts in deciding what data triage operations to perform. To help (junior) analysts perform better, several retrieval methods have been proposed to facilitate data triaging through retrieval of the relevant historical data triage operations of senior security analysts. This paper conducts a review of the existing retrieval methods, including rule-based retrieval and context-based retrieval of data triage operations. It further discusses the new directions in solving the data triage operation retrieval problem.

AB - Triage analysis is a fundamental stage in cyber operations in Security Operations Centers (SOCs). The massive data sources generate great demands on cyber security analysts’ capability of information processing and analytical reasoning. Furthermore, most junior security analysts perform much less efficiently than senior analysts in deciding what data triage operations to perform. To help (junior) analysts perform better, several retrieval methods have been proposed to facilitate data triaging through retrieval of the relevant historical data triage operations of senior security analysts. This paper conducts a review of the existing retrieval methods, including rule-based retrieval and context-based retrieval of data triage operations. It further discusses the new directions in solving the data triage operation retrieval problem.

UR - http://www.scopus.com/inward/record.url?scp=85058704884&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85058704884&partnerID=8YFLogxK

U2 - 10.1007/978-3-030-04834-1_12

DO - 10.1007/978-3-030-04834-1_12

M3 - Chapter

AN - SCOPUS:85058704884

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 227

EP - 243

BT - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

PB - Springer Verlag

ER -

Lin T, Zhong C, Yen J, Liu P. Retrieval of relevant historical data triage operations in security operation centers. In Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics). Springer Verlag. 2018. p. 227-243. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). https://doi.org/10.1007/978-3-030-04834-1_12