Integrating Perception, Comprehension, and Projection for Alert Validation: A Unified Cyber Situational Awareness Framework

Security Operation Centres SOCs must validate large volumes of alerts with limited analyst resources, yet alerts often lack sufficient context to determine whether suspicious activity is attack related. While provenance-based intrusion detection research has progressed from perception-level signa...