Year: 2025
Type: dissertation
Abstract: The growing complexity of cyberattacks and the high volume of alerts generated by Security Operations Centers (SOCs) make it increasingly difficult to prioritise and respond effectively to security incidents. The absence of clear guidelines and tools capable of adapting response procedures to different operational contexts further increases the risk of delayed or incomplete actions. This dissertation evaluates the application of Artificial Intelligence (AI) to support and automate the incident response process in SOCs through the generation of structured and context-aware playbooks. Based on the Design Science Research Methodology (DSRM), the prototype ASTRA - AI SOC Tool for Response Automation - was developed to assist analysts in triaging and responding to security alerts. The system combines natural language processing and information retrieval techniques to generate automated recommendations aligned with the main phases of incident response. ASTRA was evaluated across different attack scenarios and validated by domain experts, demonstrating practical usefulness, clarity of recommendations, and potential to improve the efficiency of SOC operations. The results show that the system fulfils its intended purpose by supporting analysts in triage and response tasks, reducing cognitive load, and promoting more consistent outcomes. It is concluded that the application of AI in the context of SOCs is feasible and contributes to a new generation of decision-support tools that combine automation with contextual reasoning.
Source: Repositório do ISCTE-IUL
Author: Godinho, Diogo Filipe Pires
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7160473709