Analyst-Aware Incident Assignment in Security Operations Centers: A Multi-Factor Prioritization and Optimization Framework

Eyup Can Kilincdemir; Baris Celiktas

Makale detayları

Analyst-Aware Incident Assignment in Security Operations Centers: A Multi-Factor Prioritization and Optimization Framework

Yazarlar:

Eyup Can Kilincdemir | Baris Celiktas

Yayıncı:

Karyay Karadeniz Yayımcılık

Ana Başlıklar:

Bilgi Güvenliği Yönetimi | Bilgi Sistemleri Organizasyonu ve Yönetimi

Dergi:

Black Sea Journal of Engineering and Science Vol.8 Issue 4, pp.1160-1180

Belge Tipi:

Makale

Yayın Tarihi:

7/2025

Belge Dili:

İngilizce

Document ID (Org No.):

2001346270

pISSN:

2619-8991

Anahtar kelimeler:

Özet:

 In this paper, we propose a comprehensive and scalable framework for incident assignment and prioritization in Security Operations Centers SOCs. The proposed model aims to optimize SOC workflows by addressing key operational challenges such as analyst fatigue, alert overload, and inconsistent incident handling. Our framework evaluates each incident using a multi-factor scoring model that incorporates incident severity, service-level agreement SLA urgency, incident type, asset criticality, threat intelligence indicators, frequency of repetition, and a correlation score derived from historical incident data. We formalize this evaluation through a set of mathematical functions that compute a dynamic incident score and derive incident complexity. In parallel, analyst profiles are quantified using Analyst Load Factor ALF and Experience Match Factor EMF, two novel metrics that account for both workload distribution and expertise alignment. The incidentanalyst matching process is expressed as a constrained optimization problem, where the final assignment score is computed by balancing incident priority with analyst suitability. This formulation enables automated, real-time assignment of incidents to the most appropriate analysts, while ensuring both operational fairness and triage precision. The model is validated using algorithmic pseudocode, scoring tables, and a simplified case study, which illustrates the real-world applicability and decision logic of the framework in large-scale SOC environments. To validate the framework under real-world conditions, an empirical case study was conducted using 10 attack scenarios from the CICIDS2017 benchmark dataset. Overall, our contributions lie in the formalization of a dual-factor analyst scoring scheme and the integration of contextual incident features into an adaptive, rule-based assignment framework. To further strengthen operational value, future work will explore adaptive weighting mechanisms and integration with real-time SIEM pipelines. Additionally, feedback loops and supervised learning models will be incorporated to continuously refine analyst-incident matching and prioritization.

 In this paper, we propose a comprehensive and scalable framework for incident assignment and prioritization in Security Operations Centers SOCs. The proposed model aims to optimize SOC workflows by addressing key operational challenges such as analyst fatigue, alert overload, and inconsistent incident handling. Our framework evaluates each incident using a multi-factor scoring model that incorporates incident severity, service-level agreement SLA urgency, incident type, asset criticality, threat intelligence indicators, frequency of repetition, and a correlation score derived from historical incident data. We formalize this evaluation through a set of mathematical functions that compute a dynamic incident score and derive incident complexity. In parallel, analyst profiles are quantified using Analyst Load Factor ALF and Experience Match Factor EMF, two novel metrics that account for both workload distribution and expertise alignment. The incidentanalyst matching process is expressed as a constrained optimization problem, where the final assignment score is computed by balancing incident priority with analyst suitability. This formulation enables automated, real-time assignment of incidents to the most appropriate analysts, while ensuring both operational fairness and triage precision. The model is validated using algorithmic pseudocode, scoring tables, and a simplified case study, which illustrates the real-world applicability and decision logic of the framework in large-scale SOC environments. To validate the framework under real-world conditions, an empirical case study was conducted using 10 attack scenarios from the CICIDS2017 benchmark dataset. Overall, our contributions lie in the formalization of a dual-factor analyst scoring scheme and the integration of contextual incident features into an adaptive, rule-based assignment framework. To further strengthen operational value, future work will explore adaptive weighting mechanisms and integration with real-time SIEM pipelines. Additionally, feedback loops and supervised learning models will be incorporated to continuously refine analyst-incident matching and prioritization.

 In this paper, we propose a comprehensive and scalable framework for incident assignment and prioritization in Security Operations Centers SOCs. The proposed model aims to optimize SOC workflows by addressing key operational challenges such as analyst fatigue, alert overload, and inconsistent incident handling. Our framework evaluates each incident using a multi-factor scoring model that incorporates incident severity, service-level agreement SLA urgency, incident type, asset criticality, threat intelligence indicators, frequency of repetition, and a correlation score derived from historical incident data. We formalize this evaluation through a set of mathematical functions that compute a dynamic incident score and derive incident complexity. In parallel, analyst profiles are quantified using Analyst Load Factor ALF and Experience Match Factor EMF, two novel metrics that account for both workload distribution and expertise alignment. The incidentanalyst matching process is expressed as a constrained optimization problem, where the final assignment score is computed by balancing incident priority with analyst suitability. This formulation enables automated, real-time assignment of incidents to the most appropriate analysts, while ensuring both operational fairness and triage precision. The model is validated using algorithmic pseudocode, scoring tables, and a simplified case study, which illustrates the real-world applicability and decision logic of the framework in large-scale SOC environments. To validate the framework under real-world conditions, an empirical case study was conducted using 10 attack scenarios from the CICIDS2017 benchmark dataset. Overall, our contributions lie in the formalization of a dual-factor analyst scoring scheme and the integration of contextual incident features into an adaptive, rule-based assignment framework. To further strengthen operational value, future work will explore adaptive weighting mechanisms and integration with real-time SIEM pipelines. Additionally, feedback loops and supervised learning models will be incorporated to continuously refine analyst-incident matching and prioritization.

 In this paper, we propose a comprehensive and scalable framework for incident assignment and prioritization in Security Operations Centers SOCs. The proposed model aims to optimize SOC workflows by addressing key operational challenges such as analyst fatigue, alert overload, and inconsistent incident handling. Our framework evaluates each incident using a multi-factor scoring model that incorporates incident severity, service-level agreement SLA urgency, incident type, asset criticality, threat intelligence indicators, frequency of repetition, and a correlation score derived from historical incident data. We formalize this evaluation through a set of mathematical functions that compute a dynamic incident score and derive incident complexity. In parallel, analyst profiles are quantified using Analyst Load Factor ALF and Experience Match Factor EMF, two novel metrics that account for both workload distribution and expertise alignment. The incidentanalyst matching process is expressed as a constrained optimization problem, where the final assignment score is computed by balancing incident priority with analyst suitability. This formulation enables automated, real-time assignment of incidents to the most appropriate analysts, while ensuring both operational fairness and triage precision. The model is validated using algorithmic pseudocode, scoring tables, and a simplified case study, which illustrates the real-world applicability and decision logic of the framework in large-scale SOC environments. To validate the framework under real-world conditions, an empirical case study was conducted using 10 attack scenarios from the CICIDS2017 benchmark dataset. Overall, our contributions lie in the formalization of a dual-factor analyst scoring scheme and the integration of contextual incident features into an adaptive, rule-based assignment framework. To further strengthen operational value, future work will explore adaptive weighting mechanisms and integration with real-time SIEM pipelines. Additionally, feedback loops and supervised learning models will be incorporated to continuously refine analyst-incident matching and prioritization.

Makale detayları

Analyst-Aware Incident Assignment in Security Operations Centers: A Multi-Factor Prioritization and Optimization Framework

Yazarlar:

Eyup Can Kilincdemir | Baris Celiktas

Yayıncı:

Karyay Karadeniz Yayımcılık

Ana Başlıklar:

Bilgi Güvenliği Yönetimi | Bilgi Sistemleri Organizasyonu ve Yönetimi

Dergi:

Black Sea Journal of Engineering and Science Vol.8 Issue 4, pp.1160-1180

Belge Tipi:

Makale

Yayın Tarihi:

7/2025

Belge Dili:

İngilizce

Document ID (Org No.):

2001346270

pISSN:

2619-8991

Incident management

Analyst assignment

SOC optimization

Incident prioritization

Correlation score

SLA urgencyIncident management

Analyst assignment

SOC optimization

Incident prioritization

Correlation score

SLA urgency

Sayı

Makale detayları

Yazarlar: Eyup Can Kilincdemir | Baris Celiktas

Yayıncı: Karyay Karadeniz Yayımcılık

Ana Başlıklar: Bilgi Güvenliği Yönetimi | Bilgi Sistemleri Organizasyonu ve Yönetimi

Dergi: Black Sea Journal of Engineering and Science Vol.8 Issue 4, pp.1160-1180

Belge Tipi: Makale

Yayın Tarihi: 7/2025

Belge Dili: İngilizce

Document ID (Org No.): 2001346270

pISSN: 2619-8991

Sayı

Yazarlar:

Eyup Can Kilincdemir | Baris Celiktas

Yayıncı:

Karyay Karadeniz Yayımcılık

Ana Başlıklar:

Bilgi Güvenliği Yönetimi | Bilgi Sistemleri Organizasyonu ve Yönetimi

Dergi:

Black Sea Journal of Engineering and Science Vol.8 Issue 4, pp.1160-1180

Belge Tipi:

Makale

Yayın Tarihi:

7/2025

Belge Dili:

İngilizce

Document ID (Org No.):

2001346270

pISSN:

2619-8991