面向SOC警报分拣的决策感知信任信号对齐
Decision-Aware Trust Signal Alignment for SOC Alert Triage
AI总结：
本文提出了一种决策感知的信任信号对齐方法，用于提升SOC警报分拣的决策支持效果。
摘要：
利用机器学习的检测系统正在逐步在安全运营中心（SOC）中实施，以帮助分析师过滤大量安全警报。实际上，此类系统往往会揭示出概率性结果或置信度分数，这些在压力下往往不准确且难以解读。之前关于SOC实践的定性研究和调查表明，低质量的警报和警报过载大大增加了分析师的负担，尤其是在工具输出不一致于决策需求或信号噪声的情况下。最显著的限制之一是模型置信度通常不表达决策过程中存在不对称成本，其中误报比漏报的危害要小得多。本文提出了一种面向SOC警报分拣的决策敏感信任信号对应方案。该框架将经过校准的置信度、轻量级不确定性提示和成本敏感的决策阈值结合到一致的决策支持层中，而不是对检测模型进行更改。为了增强概率一致性，校准是通过已知的后验方法进行的，而不确定性提示在模型确定性较低时提供保守保护。为了衡量所提模型的模型无关性能，我们应用逻辑回归和随机森林分类器到UNSW-NB15入侵检测基准测试集上。根据模拟结果，置信度显示不一致会显著增加误报率，而具有对齐信任信号的模型之间成本加权损失减少了多个数量级。最后，我们描述了一项人机交互研究计划，该计划将允许通过对齐和不一致的信任界面来经验性评估分析师的决策过程。
英文摘要：
Detection systems that utilize machine learning are progressively implemented at Security Operations Centers (SOCs) to help an analyst to filter through high volumes of security alerts. Practically, such systems tend to reveal probabilistic results or confidence scores which are ill-calibrated and hard to read when under pressure. Qualitative and survey based studies of SOC practice done before reveal that poor alert quality and alert overload greatly augment the burden on the analyst, especially when tool outputs are not coherent with decision requirements, or signal noise. One of the most significant limitations is that model confidence is usually shown without expressing that there are asymmetric costs in decision making where false alarms are much less harmful than missed attacks. The present paper presents a decision-sensitive trust signal correspondence scheme of SOC alert triage. The framework combines confidence that has been calibrated, lightweight uncertainty cues, and cost-sensitive decision thresholds into coherent decision-support layer, instead of making changes to detection models. To enhance probabilistic consistency, the calibration is done using the known post-hoc methods and the uncertainty cues give conservative protection in situations where model certainty is low. To measure the model-independent performance of the suggested model, we apply the Logistic Regression and the Random Forest classifiers to the UNSW-NB15 intrusion detection benchmark. According to simulation findings, false negatives are greatly amplified by the presence of misaligned displays of confidence, whereas cost weighted loss decreases by orders of magnitude between models with decision aligned trust signals. Lastly, we describe a human-in-the-loop study plan that would allow empirically assessing the decision-making of the analysts with aligned and misaligned trust interfaces.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
