TY - JOUR AU - Khalili, Mina AU - Zhang, Mengyuan AU - Borbor, Daniel AU - Wang, Lingyu AU - Scarabeo, Nicandro AU - Zamor, Michel-Ange PY - 2019/01/25 Y2 - 2024/03/28 TI - Monitoring and Improving Managed Security Services inside a Security Operation Center JF - EAI Endorsed Transactions on Security and Safety JA - EAI Endorsed Trans Sec Saf VL - 5 IS - 18 SE - Research article DO - 10.4108/eai.8-4-2019.157413 UR - https://publications.eai.eu/index.php/sesa/article/view/196 SP - e1 AB - <p>Monitoring and improving the performance of Security Operation Centers (SOC) are becoming crucial due to the emerging need of benefiting from Managed Security Services (MSS) rather than hiring in-house security experts. In this paper, by observing workflows of a real-world SOC, a system consisting of three different modules is designed for monitoring analysts’ activities, analysis performance measurement, and performing simulation scenarios. The system empowers managers to evaluate the SOC’s performance, which helps them to conform to Service Level Agreement (SLA) and see the need for improvement. Moreover, the designed system is strengthened by a background service module to provide feedback about anomalies or informative issues for security analysts. Three case studies have been conducted based on real data collected from the operational SOC, and simulation results have demonstrated the effectiveness of the different modules of the designed system in improving the SOC performance.</p> ER -