NORMA eResearch @NCI Library

The Rise of Cognitive SOCs: A Systematic Literature Review on AI Approaches

Binbeshr, Farid, Imam, Muhammad, Ghaleb, Mustafa, Hamdan Mohamed, Mosab, Rahim, Mussadiq Abdul and Hammoudeh, Mohammad (2025) The Rise of Cognitive SOCs: A Systematic Literature Review on AI Approaches. IEEE Open Journal of the Computer Society, 6. pp. 360-379. ISSN 2644-1268

Full text not available from this repository.
Official URL: https://doi.org/10.1109/OJCS.2025.3536800

Abstract

The increasing sophistication of cyber threats has led to the evolution of Security Operations Centers (SOCs) towards more intelligent and adaptive systems. This review explores the integration of Artificial Intelligence (AI) in SOCs, focusing on their current state, challenges, opportunities, and advantages over traditional methods. We address three key questions: (1) What are the current AI approaches in SOCs? (2) What challenges and opportunities exist with these approaches? (3) What benefits do AI models offer in SOC environments compared to traditional methods? We analyzed 38 studies using a structured methodology involving database searches, quality checks, and data extraction. Our findings show that Machine Learning (ML) techniques dominate SOC research, with a trend towards multi-approach AI methods. We classified these into ML, Natural Language Processing, multi-approach, and others, forming a detailed taxonomy of AI applications in SOCs. Challenges include data quality, model interpretability, legacy system integration, and the need for constant adaptation. Opportunities involve task automation, enhanced threat detection, real-time analysis, and adaptive learning. AI-driven SOCs show better accuracy, reduced false positives, greater scalability, and predictive capabilities than traditional approaches. This review defines Cognitive SOCs, emphasizing their ability to mimic human-like processes. We offer practical insights for SOC designers and managers on implementing AI to improve security operations. Finally, we suggest future research directions in explainable AI, human-AI collaboration, and privacy-preserving AI for SOCs.

Item Type: Article
Uncontrolled Keywords: Artificial intelligence (AI); cognitive computing; cybersecurity; deep learning; explainable AI; human-AI collaboration; machine learning; natural language processing; network security; security automation; security information and event management (SIEM); security operations center (SOC); threat detection; threat intelligence; zero trust security
Subjects: Q Science > QA Mathematics > Electronic computers. Computer science
T Technology > T Technology (General) > Information Technology > Electronic computers. Computer science
Q Science > QH Natural history > QH301 Biology > Methods of research. Technique. Experimental biology > Data processing. Bioinformatics > Artificial intelligence
Q Science > Q Science (General) > Self-organizing systems. Conscious automata > Artificial intelligence
Q Science > QA Mathematics > Computer software > Computer Security
T Technology > T Technology (General) > Information Technology > Computer software > Computer Security
Q Science > Q Science (General) > Self-organizing systems. Conscious automata > Machine learning
Divisions: School of Computing > Staff Research and Publications
Depositing User: Tamara Malone
Date Deposited: 28 Mar 2025 15:44
Last Modified: 31 Mar 2025 10:07
URI: https://norma.ncirl.ie/id/eprint/7354

Actions (login required)

View Item View Item