Towards AI-Driven Human-Machine Co-Teaming for Adaptive and Agile Cyber Security Operation Centers

TL;DR

Security Operations Centers face overwhelm from alert volumes, analyst burnout, and limited automation. The authors propose an AI-driven human–machine co-teaming framework where on-premises LLM-based AI agents learn tacit SOC knowledge from analysts through fieldwork and iterative feedback, treated as apprentices. The framework includes four data-centric modules—Data-Centric Cybersecurity Integration, Context-Aware Cyber Situational Awareness, LLM-Assisted Adaptive Decision-Making, and Explainable AI—plus learning loops and a Metrics-Augmented Generation MAG that quantifies risk with ρ(v) and ef(v) defined as $ \rho(v) = \frac{\prod_{x \in X_l^{up}} (1 - e^{-\alpha_x f_x(X(v))})}{\prod_{x \in X_l^{down}} e^{\alpha_x f_x(X(v))}} $, $ \ ef(v) = \frac{\prod_{x \in X_e^{up}} (1 - e^{-\alpha_x f_x(X(v))})}{\prod_{x \in X_e^{down}} e^{\alpha_x f_x(X(v))}} $. These outputs drive interpretable reports and actionable plans. The approach is illustrated with real-world incidents and invites collaboration to validate measurable improvements in SOC productivity and resilience.

Abstract

Security Operations Centers (SOCs) face growing challenges in managing cybersecurity threats due to an overwhelming volume of alerts, a shortage of skilled analysts, and poorly integrated tools. Human-AI collaboration offers a promising path to augment the capabilities of SOC analysts while reducing their cognitive overload. To this end, we introduce an AI-driven human-machine co-teaming paradigm that leverages large language models (LLMs) to enhance threat intelligence, alert triage, and incident response workflows. We present a vision in which LLM-based AI agents learn from human analysts the tacit knowledge embedded in SOC operations, enabling the AI agents to improve their performance on SOC tasks through this co-teaming. We invite SOCs to collaborate with us to further develop this process and uncover replicable patterns where human-AI co-teaming yields measurable improvements in SOC productivity.

Figures (5)

• Figure 1: SECI model for anthropology-guided SOC tool building.
• Figure 2: Our vision for human-machine co-teaming for SOC operations.
• Figure 3: Overview of the proposed framework.
• Figure 4: Example of graphical model.
• Figure 5: Timeline of the DNC attack.