Synthesis and Evaluation of a Network Threat Analysis Process for Tier 1 SOC Investigations

Explore a 16-minute conference talk from USENIX's SOUPS 2023 that presents a structured approach to network threat analysis for Tier 1 investigations in Security Operation Centers (SOCs). Discover how researchers from Eindhoven University of Technology collaborated with a commercial SOC to develop a 4-stage threat analysis process aimed at improving the efficiency and accuracy of Tier 1 analysts. Learn about the experimental results showing that analysts using this structured approach were 2.5 times more likely to produce accurate assessments compared to those who didn't. Gain insights into the qualitative effects of the process on analyst decision-making and its implications for both practical applications and future research in the field of cybersecurity operations.