1. Home
  2. Vol 2, No 11 (2024)
  3. Nurhaliza

Analisis Perbandingan Kinerja Algoritma Pembelajaran Mesin dalam Proses Triase Insiden Keamanan Siber

Author


Mutiara Nurhaliza(1Mail), Rehana Putri Salsabila(2), Salsabila Amalia Harjanto(3),
(1) Department of Information Technology, Sepuluh Nopember Institute of Technology Surabaya, Indonesia,
(2) ,
(3) ,

Mail Corresponding Author
Article Analytic
  [File Size: 186KB]  Language: en
Available online: 2024-12-09  |  Published : 2024-12-09
Copyright (c) 2024 Mutiara Nurhaliza, Rehana Putri Salsabila, Salsabila Amalia Harjanto
Article can trace at:

Article Metrics

Abstract Views: 76 times PDF Downloaded: 77 times

Abstract


The increasing complexity of cyber threats demands higher efficiency in incident management, particularly in Security Operation Centers (SOCs). Incident triage processes are often hindered by a high number of false positives, reducing effectiveness in addressing critical threats. This study develops a machine learning model to classify security incidents using the GUIDE dataset, which includes over one million incidents from 6,100 organizations. Five machine learning algorithms were tested: Random Forest, SVM, XGBoost, KNN, and Logistic Regression, with preprocessing steps such as One-Hot Encoding, normalization, and stratified data splitting. Evaluation results show that Random Forest and XGBoost achieved the highest accuracy of 91%, with superior capabilities in reducing false positives and prioritizing relevant threats.


Keywords


Cybersecurity, Incident Management, Security Operation Centers (SOCs), Machine Learning, False Positives, Threat Classification.

References


Gelman, B., Taoufiq, S., Vrs, T., & Berlin, K. (2023). That Escalated Quickly: An ML Framework for Alert Prioritization. ArXiv, abs/2302.06648. https://doi.org/10.48550/arXiv.2302.06648.

Trifonov, R., Manolov, S., Tsochev, G., & Pavlova, G. (2020). Automation of Cyber Security Incident Handling through Artificial Intelligence Methods. .

Peng, Y., Zhang, Y., Tang, Y., & Li, S. (2011). An incident information management framework based on data integration, data mining, and multi-criteria decision making. Decis. Support Syst., 51, 316-327. https://doi.org/10.1016/j.dss.2010.11.025.

Freitas, S., Kalajdjieski, J., Gharib, A., & McCann, R. (2024). AI-Driven Guided Response for Security Operation Centers with Microsoft Copilot for Security. https://arxiv.org/abs/2407.09017v4


Refbacks

  • There are currently no refbacks.

Creative Commons License
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.