{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,5]],"date-time":"2026-05-05T08:22:55Z","timestamp":1777969375353,"version":"3.51.4"},"reference-count":30,"publisher":"Association for Computing Machinery (ACM)","issue":"5","license":[{"start":{"date-parts":[[2018,4,24]],"date-time":"2018-04-24T00:00:00Z","timestamp":1524528000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100000183","name":"Army Research Office","doi-asserted-by":"crossref","award":["W911NF-15-1-0576 and W911NF-13-1-0421"],"award-info":[{"award-number":["W911NF-15-1-0576 and W911NF-13-1-0421"]}],"id":[{"id":"10.13039\/100000183","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/100000006","name":"Office of Naval Research","doi-asserted-by":"crossref","award":["N00014-15-1-2007"],"award-info":[{"award-number":["N00014-15-1-2007"]}],"id":[{"id":"10.13039\/100000006","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Intell. Syst. Technol."],"published-print":{"date-parts":[[2018,9,30]]},"abstract":"<jats:p>The analysts at a cybersecurity operations center (CSOC) analyze the alerts that are generated by intrusion detection systems (IDSs). Under normal operating conditions, sufficient numbers of analysts are available to analyze the alert workload. For the purpose of this article, this means that the cybersecurity analysts in each shift can fully investigate each and every alert that is generated by the IDSs in a reasonable amount of time and perform their normal tasks in a shift. Normal tasks include analysis time, time to attend training programs, report writing time, personal break time, and time to update the signatures on new patterns in alerts as detected by the IDS. There are several disruptive factors that occur randomly and can adversely impact the normal operating condition of a CSOC, such as (1) higher alert generation rates from a few IDSs, (2) new alert patterns that decrease the throughput of the alert analysis process, and (3) analyst absenteeism. The impact of the preceding factors is that the alerts wait for a long duration before being analyzed, which impacts the level of operational effectiveness (LOE) of the CSOC. To return the CSOC to normal operating conditions, the manager of a CSOC can take several actions, such as increasing the alert analysis time spent by analysts in a shift by canceling a training program, spending some of his own time to assist the analysts in alert investigation, and calling upon the on-call analyst workforce to boost the service rate of alerts. However, additional resources are limited in quantity over a 14-day work cycle, and the CSOC manager must determine when and how much action to take in the face of uncertainty, which arises from both the intensity and the random occurrences of the disruptive factors. The preceding decision by the CSOC manager is nontrivial and is often made in an ad hoc manner using prior experiences. This work develops a reinforcement learning (RL) model for optimizing the LOE throughout the entire 14-day work cycle of a CSOC in the face of uncertainties due to disruptive events. Results indicate that the RL model is able to assist the CSOC manager with a decision support tool to make better decisions than current practices in determining when and how much resource to allocate when the LOE of a CSOC deviates from the normal operating condition.<\/jats:p>","DOI":"10.1145\/3173457","type":"journal-article","created":{"date-parts":[[2018,4,25]],"date-time":"2018-04-25T12:22:17Z","timestamp":1524658937000},"page":"1-20","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":16,"title":["Dynamic Optimization of the Level of Operational Effectiveness of a CSOC Under Adverse Conditions"],"prefix":"10.1145","volume":"9","author":[{"given":"Ankit","family":"Shah","sequence":"first","affiliation":[{"name":"George Mason University, Fairfax, VA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Rajesh","family":"Ganesan","sequence":"additional","affiliation":[{"name":"George Mason University, Fairfax, VA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3210-558X","authenticated-orcid":false,"given":"Sushil","family":"Jajodia","sequence":"additional","affiliation":[{"name":"George Mason University, Fairfax, VA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Hasan","family":"Cam","sequence":"additional","affiliation":[{"name":"Army Research Laboratory, Adelphi, MD"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2018,4,24]]},"reference":[{"key":"e_1_2_2_1_1","doi-asserted-by":"publisher","DOI":"10.1016\/S0921-8890(00)00087-7"},{"key":"e_1_2_2_2_1","volume-title":"Advances in Information Security","volume":"6","author":"Barbar\u00e1 Daniel","year":"2002","unstructured":"Daniel Barbar\u00e1 and Sushil Jajodia ( Eds .). 2002 . Application of Data Mining in Computer Security . Advances in Information Security , Vol. 6 . Springer. Daniel Barbar\u00e1 and Sushil Jajodia (Eds.). 2002. Application of Data Mining in Computer Security. Advances in Information Security, Vol. 6. Springer."},{"key":"e_1_2_2_3_1","volume-title":"Dynamic Programming","author":"Bellman Richard","unstructured":"Richard Bellman . 1957. Dynamic Programming . Princeton University Press , Princeton NJ . Richard Bellman. 1957. Dynamic Programming. Princeton University Press, Princeton NJ."},{"key":"e_1_2_2_4_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2014.103"},{"key":"e_1_2_2_5_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10111-010-0159-y"},{"key":"e_1_2_2_6_1","volume-title":"DON Cyber Crime Handbook. U.S. Department of the Navy","author":"CIO.","unstructured":"CIO. 2008. DON Cyber Crime Handbook. U.S. Department of the Navy , Washington, DC . CIO. 2008. DON Cyber Crime Handbook. U.S. Department of the Navy, Washington, DC."},{"key":"e_1_2_2_7_1","volume-title":"Intrusion Detection Systems. Advances in Information Security","volume":"38","author":"Pietro Roberto Di","unstructured":"Roberto Di Pietro and Luigi V . Mancini (Eds.). 2008 . Intrusion Detection Systems. Advances in Information Security , Vol. 38 . Springer. Roberto Di Pietro and Luigi V. Mancini (Eds.). 2008. Intrusion Detection Systems. Advances in Information Security, Vol. 38. Springer."},{"key":"e_1_2_2_8_1","doi-asserted-by":"publisher","DOI":"10.1093\/cybsec\/tyw003"},{"key":"e_1_2_2_9_1","doi-asserted-by":"publisher","DOI":"10.1108\/09685221011035241"},{"key":"e_1_2_2_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/2914795"},{"key":"e_1_2_2_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/2882969"},{"key":"e_1_2_2_12_1","volume-title":"Simulation Based Optimization: Parametric Optimization Techniques and Reinforcement Learning","author":"Gosavi Abhijit","unstructured":"Abhijit Gosavi . 2003. Simulation Based Optimization: Parametric Optimization Techniques and Reinforcement Learning . Kluwer Academic , Norwell, MA . Abhijit Gosavi. 2003. Simulation Based Optimization: Parametric Optimization Techniques and Reinforcement Learning. Kluwer Academic, Norwell, MA."},{"key":"e_1_2_2_13_1","volume-title":"Fundamentals of Queuing Theory","author":"Gross Donald","unstructured":"Donald Gross , John Shortle , James Thompson , and Carl Harris . 2008. Fundamentals of Queuing Theory . Wiley InterScience , New York, NY . Donald Gross, John Shortle, James Thompson, and Carl Harris. 2008. Fundamentals of Queuing Theory. Wiley InterScience, New York, NY."},{"key":"e_1_2_2_14_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1937-5956.2011.01231.x"},{"key":"e_1_2_2_15_1","volume-title":"Sobel","author":"Heyman Daniel P.","year":"2004","unstructured":"Daniel P. Heyman and Matthew J . Sobel . 2004 . Stochastic Models in Operations Research : Stochastic Processes and Operating Characteristics. Vol. 1 . Dover Publications . Daniel P. Heyman and Matthew J. Sobel. 2004. Stochastic Models in Operations Research: Stochastic Processes and Operating Characteristics. Vol. 1. Dover Publications."},{"key":"e_1_2_2_16_1","volume-title":"Department of Energy Cyber Security Incidents","author":"Kuypers Marshall","unstructured":"Marshall Kuypers and Elisabeth Pat\u00e9-Cornell . 2016. Department of Energy Cyber Security Incidents . Center for International Security and Cooperation , Stanford, CA . https:\/\/cisac.fsi.stanford.edu\/sites\/default\/files\/doe_cyber_security_incidents.pdf. Marshall Kuypers and Elisabeth Pat\u00e9-Cornell. 2016. Department of Energy Cyber Security Incidents. Center for International Security and Cooperation, Stanford, CA. https:\/\/cisac.fsi.stanford.edu\/sites\/default\/files\/doe_cyber_security_incidents.pdf."},{"key":"e_1_2_2_17_1","volume-title":"Network Intrusion Detection","author":"Northcutt Stephen","unstructured":"Stephen Northcutt and Judy Novak . 2002. Network Intrusion Detection ( 3 rd ed.). New Riders Publishing , Thousand Oaks, CA . Stephen Northcutt and Judy Novak. 2002. Network Intrusion Detection (3rd ed.). New Riders Publishing, Thousand Oaks, CA.","edition":"3"},{"key":"e_1_2_2_18_1","volume-title":"Approximate Dynamic Programming: Solving the Curses of Dimensionality","author":"Powell Warren B.","unstructured":"Warren B. Powell . 2007. Approximate Dynamic Programming: Solving the Curses of Dimensionality . Wiley InterScience . Warren B. Powell. 2007. Approximate Dynamic Programming: Solving the Curses of Dimensionality. Wiley InterScience."},{"key":"e_1_2_2_19_1","volume-title":"Markov Decision Processes","author":"Puterman Martin L.","unstructured":"Martin L. Puterman . 1994. Markov Decision Processes . Wiley InterScience , New York, NY . Martin L. Puterman. 1994. Markov Decision Processes. Wiley InterScience, New York, NY."},{"key":"e_1_2_2_20_1","volume-title":"USA Today. Retrieved","author":"Reilly Stephen","year":"2015","unstructured":"Stephen Reilly . 2015 . Records: Energy Department struck by cyber attacks . USA Today. Retrieved March 16, 2018, from https:\/\/www.usatoday.com\/story\/news\/2015\/09\/09\/cyber-attacks-doe-energy\/71929786\/. Stephen Reilly. 2015. Records: Energy Department struck by cyber attacks. USA Today. Retrieved March 16, 2018, from https:\/\/www.usatoday.com\/story\/news\/2015\/09\/09\/cyber-attacks-doe-energy\/71929786\/."},{"key":"e_1_2_2_21_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10207-017-0365-1"},{"key":"e_1_2_2_22_1","unstructured":"Satinder Singh and Dimitri Bertsekas. 1997. Reinforcement learning for dynamic channel allocation in cellular telephone systems. In Advances in Neural Information Processing Systems 9 (NIPS\u201996). 974--980.   Satinder Singh and Dimitri Bertsekas. 1997. Reinforcement learning for dynamic channel allocation in cellular telephone systems. In Advances in Neural Information Processing Systems 9 (NIPS\u201996). 974--980."},{"key":"e_1_2_2_23_1","volume-title":"Proceedings of the 2nd Singapore Cyber-Security R&D Conference (SG-CRC\u201917)","author":"Smith Matthew","year":"2017","unstructured":"Matthew Smith and Elisabeth Pat\u00e9-Cornell . 2017 . Cyber risk analysis for a smart grid: How smart is smart enough? A multi-armed bandit approach . In Proceedings of the 2nd Singapore Cyber-Security R&D Conference (SG-CRC\u201917) . 37--56. Matthew Smith and Elisabeth Pat\u00e9-Cornell. 2017. Cyber risk analysis for a smart grid: How smart is smart enough? A multi-armed bandit approach. In Proceedings of the 2nd Singapore Cyber-Security R&D Conference (SG-CRC\u201917). 37--56."},{"key":"e_1_2_2_24_1","doi-asserted-by":"crossref","unstructured":"V. S. Subrahmanian M. Ovelgonne T. Dumitras and A. Prakash. 2015. The Global Cyber-Vulnerability Report. Springer.   V. S. Subrahmanian M. Ovelgonne T. Dumitras and A. Prakash. 2015. The Global Cyber-Vulnerability Report. Springer.","DOI":"10.1007\/978-3-319-25760-0"},{"key":"e_1_2_2_25_1","volume-title":"Proceedings of the 12th Symposium on Usable Privacy and Security (SOUPS\u201916)","author":"Sundaramurthy Sathya Chandran","unstructured":"Sathya Chandran Sundaramurthy , John McHugh , Xinming Ou , Michael Wesch , Alexandru G Bardas , and S. Raj Rajagopalan . 2016. Turning contradictions into innovations or: How we learned to stop whining and improve security operations . In Proceedings of the 12th Symposium on Usable Privacy and Security (SOUPS\u201916) . Sathya Chandran Sundaramurthy, John McHugh, Xinming Ou, Michael Wesch, Alexandru G Bardas, and S. Raj Rajagopalan. 2016. Turning contradictions into innovations or: How we learned to stop whining and improve security operations. In Proceedings of the 12th Symposium on Usable Privacy and Security (SOUPS\u201916)."},{"key":"e_1_2_2_26_1","volume-title":"Barto","author":"Sutton Richard","year":"1998","unstructured":"Richard Sutton and Andrew G . Barto . 1998 . In Reinforcement Learning. MIT Press , Cambridge, MA. Richard Sutton and Andrew G. Barto. 1998. In Reinforcement Learning. MIT Press, Cambridge, MA."},{"key":"e_1_2_2_27_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.trb.2006.06.006"},{"key":"e_1_2_2_28_1","volume-title":"Linear Multivariable Control: A Geometric Approach","author":"Wonham W.","unstructured":"W. Wonham . 1979. Linear Multivariable Control: A Geometric Approach . Faller-Verlag . W. Wonham. 1979. Linear Multivariable Control: A Geometric Approach. Faller-Verlag."},{"key":"e_1_2_2_29_1","volume-title":"Steinke","author":"Zaccaro Stephen J.","year":"2016","unstructured":"Stephen J. Zaccaro , Reeshad S. Dalal , Lois E. Tetrick , and Julie A . Steinke . 2016 . Psychosocial Dynamics of Cyber Security. Routledge . Stephen J. Zaccaro, Reeshad S. Dalal, Lois E. Tetrick, and Julie A. Steinke. 2016. Psychosocial Dynamics of Cyber Security. Routledge."},{"key":"e_1_2_2_30_1","volume-title":"The Strategies of a World-Class Cybersecurity Operations Center","author":"Zimmerman Carson","unstructured":"Carson Zimmerman . 2014. The Strategies of a World-Class Cybersecurity Operations Center . MITRE Corporation , Mc Lean, VA . Carson Zimmerman. 2014. The Strategies of a World-Class Cybersecurity Operations Center. MITRE Corporation, McLean, VA."}],"container-title":["ACM Transactions on Intelligent Systems and Technology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3173457","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3173457","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3173457","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T03:02:45Z","timestamp":1750215765000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3173457"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2018,4,24]]},"references-count":30,"journal-issue":{"issue":"5","published-print":{"date-parts":[[2018,9,30]]}},"alternative-id":["10.1145\/3173457"],"URL":"https:\/\/doi.org\/10.1145\/3173457","relation":{},"ISSN":["2157-6904","2157-6912"],"issn-type":[{"value":"2157-6904","type":"print"},{"value":"2157-6912","type":"electronic"}],"subject":[],"published":{"date-parts":[[2018,4,24]]},"assertion":[{"value":"2017-08-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2017-12-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2018-04-24","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}