With the rapid development of technologies such as artificial intelligence and big data, the methods of cyber attacks have become increasingly complex and intelligent. Traditional security operation models rely on manual analysis and response, making it difficult to cope with the massive volume of security alerts and complex attack methods. The Intelligent Security Operations Center (AISOC) integrates AI technology and big data analysis to achieve a fully automated process from threat detection to response, significantly enhancing the efficiency and accuracy of security operations.
1.Technical Architecture of the Intelligent Security Operations Center
(1) AI Driven Full-Process Empowerment
The Intelligent Security Operations Center (AISOC) is centered around a self-developed security large model (QAX-GPT), combined with a big data processing engine (NOAH), a big data correlation engine (SABRE), and a security orchestration and automated response engine (SOAR), achieving full-process automation from threat detection, alert analysis, incident investigation to response.
1.Alert Noise Reduction and Intelligent Analysis
The alert noise reduction function of AISOC uses intelligent alert triage technology to automatically filter false positives, identify accurate alerts, merge duplicate alerts, and reclassify and reorder them. The preset model can eliminate over 98% of alert noise. The intelligent analysis function integrates with QAX-GPT through a bidirectional API , providing real-time analysis of high-value alerts, delivering accurate qualitative conclusions and reports, with analysis efficiency improved by 60 times compared to human analysts, and a false positive rate less than half that of humans.
2.Intelligent Investigation and Response
The intelligent investigation function of AISOC relies on natural language dialogue and automated processing to quickly complete incident investigation and tracing, reducing investigation time by nearly a thousand times. The intelligent response function uses automated scripts and robots to quickly handle security incidents, curbing the spread of threats.
(2) Multi-Dimensional Data Integration and Analysis
AISOC supports the integration and analysis of multi-source heterogeneous data, including network traffic data, endpoint logs, application logs, and security device alerts. Through the big data correlation engine (SABRE), AISOC can achieve global threat visibility across data sources, covering 354 attack techniques in the MITRE ATT&CK framework, providing comprehensive threat detection capabilities.
(3) Automated Operations and Closed-Loop Management
AISOC ’s automated operation function, through the security orchestration and automated response engine (SOAR), achieves full-process automation from threat detection to response. The system can automatically identify attack methods, assess impact, generate response strategies, and complete closed-loop management of incidents through automated tasks.
2.Functional Characteristics of the Intelligent Security Operations Center
(1) Comprehensive Security Operation Solutions
AISOC provides a comprehensive security operation solution covering threat detection, intelligent analysis, incident analysis, threat hunting, risk assessment, and policy optimization. It can meet the needs of different industries and provide customized solutions.
(2) Efficient Data Processing and Analysis Capabilities
AISOC supports real-time processing and analysis of massive data, quickly identifying potential threats. The system is pre-configured with 2400+ parsing rules, 1200+ correlation rules, and 100+ triage models, supporting automated parsing of 1000+ data sources without manual configuration.
(3) AI Intelligent Applications
The AI intelligent applications of AISOC run through all aspects of security operations, including security knowledge Q&A, report generation, threat intelligence analysis, and SOAR playbook generation, etc. The AI technology not only improves the efficiency and accuracy of alert handling but also reduces reliance on professional security analysts.
(4) Visualization and Quantitative Operation System
AISOC provides rich visual dashboards and quantitative metrics, making the results of security construction and operational effectiveness tangible. Through customized quantitative metrics, enterprises can intuitively demonstrate the effectiveness of security operations, providing a scientific basis for security decision-making and investment planning.