Evaluating cybersecurity defenses with a data science approach

Brennan Lodge

Abstract

SOC analysts are under siege to keep pace with the ever-changing threat landscape. The analysts are overworked, burnout and bombarded with the sheer number of alerts that they must carefully investigate. This intense workload can be a true testament against anyone’s patience. We need to empower the Security Operations Center (SOC) analysts with data science implementations to overcome this monotonous work that is leading to career burnout. Security departments should be seeking data-driven approaches for more efficient evaluations on operations. Data Science use cases like detection rule scoring and DGA detection through machine learning are example implementations with immediate value add. With this insight security engineers, management and analysts alike can be empowered to make data driven decisions to tune and lessen the burden on the SOC from investigating fewer false positive related cases.