{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,6]],"date-time":"2026-10-06T22:25:01Z","timestamp":1791325501538,"version":"4.3.1"},"reference-count":64,"publisher":"Association for Computing Machinery (ACM)","content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Internet Technol."],"abstract":"<jats:p>Security Operations Centers (SOCs) face growing challenges in managing cybersecurity threats due to an overwhelming volume of alerts, a shortage of skilled analysts, and poorly integrated tools. Human-AI collaboration offers a promising path to augment the capabilities of analysts while reducing cognitive overload. To this end, we introduce an AI-driven human-machine co-teaming paradigm that leverages large language models (LLMs) to support threat intelligence, alert triage, and incident response workflows. We present a vision in which LLM-based agents learn from human analysts the tacit knowledge embedded in SOC operations, enabling them to progressively improve their performance on operational tasks. Our approach involves close collaboration with SOCs to refine this process and identify replicable patterns where human-AI co-teaming improves operational efficiency. To illustrate the feasibility of this paradigm, we report lessons learned from a preliminary case study conducted in partnership with a real SOC.<\/jats:p>","DOI":"10.1145\/3819819","type":"journal-article","created":{"date-parts":[[2026,6,2]],"date-time":"2026-06-02T21:49:37Z","timestamp":1780436977000},"update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":3,"title":["Towards AI-Driven Human-Machine Co-Teaming for Adaptive and Agile Cyber Security Operation Centers"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-2675-5810","authenticated-orcid":false,"given":"Massimiliano","family":"Albanese","sequence":"first","affiliation":[{"name":"Center for Infrastructure Security in the Era of AI, George Mason University","place":["Fairfax, United States"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-2501-7991","authenticated-orcid":false,"given":"Xinming","family":"Ou","sequence":"additional","affiliation":[{"name":"University of South Florida","place":["Tampa, United States"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5798-2664","authenticated-orcid":false,"given":"Kevin","family":"Lybarger","sequence":"additional","affiliation":[{"name":"Department of Information Sciences and Technology, George Mason University","place":["Fairfax, United States"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4669-440X","authenticated-orcid":false,"given":"Daniel","family":"Lende","sequence":"additional","affiliation":[{"name":"University of South Florida","place":["Tampa, United States"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5461-863X","authenticated-orcid":false,"given":"Dmitry","family":"Goldgof","sequence":"additional","affiliation":[{"name":"University of South Florida","place":["Tampa, United States"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-6686-6456","authenticated-orcid":false,"given":"Faayed Al","family":"Faisal","sequence":"additional","affiliation":[{"name":"University of South Florida","place":["Tampa, United States"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-8758-2591","authenticated-orcid":false,"given":"Kritan","family":"Banstola","sequence":"additional","affiliation":[{"name":"University of South Florida","place":["Tampa, United States"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-4408-155X","authenticated-orcid":false,"given":"Arka","family":"Ghosh","sequence":"additional","affiliation":[{"name":"Center for Infrastructure Security in the Era of AI, George Mason University","place":["Fairfax, United States"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,6,2]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICWR54782.2022.9786234"},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.3390\/app10155208"},{"key":"e_1_2_1_3_1","volume-title":"Proceedings of the 31st USENIX Security Symposium (USENIX Security","author":"Alahmadi A.","year":"2022","unstructured":"B.\u00a0A. Alahmadi, L. Axon, and I. Martinovic. 2022. 99% False Positives: A Qualitative Study of SOC Analysts\u2019 Perspectives on Security Alarms. In Proceedings of the 31st USENIX Security Symposium (USENIX Security 2022). Boston, MA, USA, 2783\u20132800. https:\/\/www.usenix.org\/system\/files\/sec22-alahmadi.pdf"},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","unstructured":"M. Albanese I. Iganibo and O. Adebiyi. 2023. A Framework for Designing Vulnerability Metrics. Computers & Security 132 (September 2023) 11 pages. doi: 10.1016\/j.cose.2023.103382","DOI":"10.1016\/j.cose.2023.103382"},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1177\/1548512917706043"},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1109\/IRI.2007.4296632"},{"key":"e_1_2_1_7_1","volume-title":"Proceedings of the DARPA Broadcast News Transcription and Understanding Workshop. 194\u2013218","author":"Allan J.","unstructured":"J. Allan, J. Carbonell, G. Doddington, J. Yamron, and Y. Yang. 1998. Topic Detection and Tracking Pilot Study: Final Report. In Proceedings of the DARPA Broadcast News Transcription and Understanding Workshop. 194\u2013218. https:\/\/ciir.cs.umass.edu\/pubfiles\/ir-137.pdf"},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","unstructured":"E. Almazrouei H. Alobeidli A. Alshamsi A. Cappelli R. Cojocaru M. Debbah \u00c9. Goffinet D. Hesslow J. Launay and Q. Malartic. 2023. The Falcon Series of Open Language Models. arXiv (2023). doi: 10.48550\/arXiv.2311.16867","DOI":"10.48550\/arXiv.2311.16867"},{"key":"e_1_2_1_9_1","unstructured":"Internet Archive. [n.\u00a0d.]. Wayback Machine. http:\/\/web.archive.org\/ [Accessed: Jan. 24 2025]."},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1155\/2021\/8833084"},{"key":"e_1_2_1_11_1","volume-title":"Standardizing Cyber Threat Intelligence Information with the Structured Threat Information Expression (STIX\u2122)","author":"Barnum S.","unstructured":"S. Barnum. 2012. Standardizing Cyber Threat Intelligence Information with the Structured Threat Information Expression (STIX\u2122). The MITRE Corporation. https:\/\/www.mitre.org\/sites\/default\/files\/publications\/stix.pdf"},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1145\/3652594"},{"key":"e_1_2_1_13_1","volume-title":"Analyzing Qualitative Data: Systematic Approaches","author":"Bernard R.","unstructured":"H.\u00a0R. Bernard, A. Wutich, and G.\u00a0W. Ryan. 2016. Analyzing Qualitative Data: Systematic Approaches. SAGE Publications. https:\/\/uk.sagepub.com\/en-gb\/eur\/analyzing-qualitative-data\/book240717"},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1016\/S0169-7552(98)00110-X"},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-31469-8_3"},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","unstructured":"Y. Chen M. Cui D. Wang Y. Cao P. Yang B. Jiang Z. Lu and B. Liu. 2024. A Survey of Large Language Models for Cyber Threat Detection. Computers & Security (July 2024). doi: 10.1016\/j.cose.2024.104016","DOI":"10.1016\/j.cose.2024.104016"},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/3607199.3607242"},{"key":"e_1_2_1_18_1","unstructured":"CrowdStrike. 2020. CrowdStrike\u2019s Work with the Democratic National Committee: Setting the Record Straight. CrowdStrike Blog. https:\/\/www.crowdstrike.com\/blog\/bears-midst-intrusion-democratic-national-committee\/"},{"key":"e_1_2_1_19_1","volume-title":"Proceedings of the 33rd USENIX Security Symposium (USENIX Security 24)","author":"Deng G.","unstructured":"G. Deng, Y. Liu, V. Mayoral-Vilches, P. Liu, Y. Li, Y. Xu, T. Zhang, Y. Liu, M. Pinzger, and S. Rass. 2024. PentestGPT: Evaluating and Harnessing Large Language Models for Automated Penetration Testing. In Proceedings of the 33rd USENIX Security Symposium (USENIX Security 24). Philadelphia, PA, USA, 847\u2013864. https:\/\/www.usenix.org\/conference\/usenixsecurity24\/presentation\/deng"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/3637528.3671470"},{"key":"e_1_2_1_21_1","doi-asserted-by":"crossref","first-page":"554","DOI":"10.1370\/afm.2453","article-title":"The 3 Cs of Content, Context, and Concepts: A Practical Approach to Recording Unstructured Field Observations","volume":"17","author":"Fetters D.","year":"2019","unstructured":"M.\u00a0D. Fetters and E.\u00a0B. Rubinstein. 2019. The 3 Cs of Content, Context, and Concepts: A Practical Approach to Recording Unstructured Field Observations. The Annals of Family Medicine 17, 6 (2019), 554\u2013560. https:\/\/pmc.ncbi.nlm.nih.gov\/articles\/PMC6846267\/","journal-title":"The Annals of Family Medicine"},{"key":"e_1_2_1_22_1","volume-title":"Significant Cyber Incidents. Strategic Technologies Program. https:\/\/www.csis.org\/programs\/strategic-technologies-program\/significant-cyber-incidents [Accessed","author":"Center for Strategic and International\u00a0Studies (CSIS). [n.\u00a0d.].","year":"2025","unstructured":"Center for Strategic and International\u00a0Studies (CSIS). [n.\u00a0d.]. Significant Cyber Incidents. Strategic Technologies Program. https:\/\/www.csis.org\/programs\/strategic-technologies-program\/significant-cyber-incidents [Accessed: Jan. 24, 2025]."},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.3390\/sym12030354"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1177\/1474022214543874"},{"key":"e_1_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/3611643.3613083"},{"key":"e_1_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1109\/access.2024.3505983"},{"key":"e_1_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.48550\/arxiv.2403.01271"},{"key":"e_1_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1002\/spy2.298"},{"key":"e_1_2_1_29_1","doi-asserted-by":"crossref","unstructured":"Ibifubara Iganibo Massimiliano Albanese Kaan Turkmen Thomas\u00a0R Campbell and Marc Mosko. 2022. Mason Vulnerability Scoring Framework: A Customizable Framework for Scoring Common Vulnerabilities and Weaknesses.. In SECRYPT. 215\u2013225.","DOI":"10.5220\/0011277400003283"},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2310.06825"},{"key":"e_1_2_1_31_1","unstructured":"D. Jin S. Mehri D. Hazarika A. Padmakumar S. Lee Y. Liu and M. Namazifar. 2023. Data-Efficient Alignment of Large Language Models with Human Feedback Through Natural Language. Amazon Science. https:\/\/www.amazon.science\/publications\/data-efficient-alignment-of-large-language-models-with-human-feedback-through-natural-language"},{"key":"e_1_2_1_32_1","volume-title":"Proceedings of the 32nd USENIX Security Symposium (USENIX Security","author":"Jones R.","year":"2023","unstructured":"K.\u00a0R. Jones, D.\u00a0A. Brucker-Hahn, B. Fidler, and A.\u00a0G. Bardas. 2023. Work-From-Home and COVID-19: Trajectories of Endpoint Security Management in a Security Operations Center. In Proceedings of the 32nd USENIX Security Symposium (USENIX Security 2023). Anaheim, CA, USA, 2293\u20132310. https:\/\/www.usenix.org\/system\/files\/usenixsecurity23-jones.pdf"},{"key":"e_1_2_1_33_1","volume-title":"The Interview as Anti-North Korean Propaganda. NK News (March","author":"Jong S.","year":"2015","unstructured":"S. Jong. 2015. The Interview as Anti-North Korean Propaganda. NK News (March 2015). https:\/\/www.nknews.org\/2015\/03\/the-interview-as-anti-north-korean-propaganda\/"},{"key":"e_1_2_1_34_1","volume-title":"Geoffrey Hinton tells us why he\u2019s now scared of the tech he helped build. MIT Technology Review (May","author":"Knight W.","year":"2023","unstructured":"W. Knight. 2023. Geoffrey Hinton tells us why he\u2019s now scared of the tech he helped build. MIT Technology Review (May 2023). https:\/\/www.technologyreview.com\/2023\/05\/02\/1072528\/geoffrey-hinton-google-why-scared-ai\/"},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10586-019-03008-x"},{"key":"e_1_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.17730\/1938-3525-82.1.13"},{"key":"e_1_2_1_37_1","doi-asserted-by":"publisher","unstructured":"M. Levi Y. Alluouche D. Ohayon and A. Puzanov. 2024. CyberPal.AI: Empowering LLMs with Expert-Driven Cybersecurity Instructions. arXiv (August 2024). doi: 10.48550\/arXiv.2408.09304","DOI":"10.48550\/arXiv.2408.09304"},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1109\/isdfs60797.2024.10527236"},{"key":"e_1_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISA.2008.11"},{"key":"e_1_2_1_40_1","unstructured":"Trend Micro. 2014. The Hack of Sony Pictures: What We Know and What You Need to Know. Trend Micro Security News. https:\/\/www.trendmicro.com\/vinfo\/us\/security\/news\/cyber-attacks\/the-hack-of-sony-pictures-what-you-need-to-know"},{"key":"e_1_2_1_41_1","unstructured":"Trend Micro. 2018. A Look into the Lazarus Group\u2019s Operations. Trend Micro Security News. https:\/\/www.trendmicro.com\/vinfo\/us\/security\/news\/cybercrime-and-digital-threats\/a-look-into-the-lazarus-groups-operations"},{"key":"e_1_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/3605943"},{"key":"e_1_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.48550\/arxiv.2401.10036"},{"key":"e_1_2_1_44_1","doi-asserted-by":"publisher","unstructured":"J. Navarro A. Deruyver and P. Parrend. 2018. A Systematic Survey on Multi-Step Attack Detection. Computers & Security 76(July 2018) 214\u2013249. doi: 10.1016\/j.cose.2018.03.001","DOI":"10.1016\/j.cose.2018.03.001"},{"key":"e_1_2_1_45_1","doi-asserted-by":"crossref","unstructured":"I. Nonaka and H. Takeuchi. 1995. The Knowledge-Creating Company: How Japanese Companies Create the Dynamics of Innovation. Oxford University Press New York. https:\/\/academic.oup.com\/book\/52097","DOI":"10.1093\/oso\/9780195092691.001.0001"},{"key":"e_1_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2024.3352100"},{"key":"e_1_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1017\/S0031819100066110"},{"key":"e_1_2_1_48_1","volume-title":"The Tacit Dimension","author":"Polanyi M.","unstructured":"M. Polanyi. 1966. The Tacit Dimension. Doubleday & Company, Inc., New York."},{"key":"e_1_2_1_49_1","volume-title":"Proceedings of the Workshop on SOC Operations and Construction (WOSOC 2024","author":"Shashwat K.","year":"2024","unstructured":"K. Shashwat, F. Hahn, X. Ou, D. Goldgof, L. Hall, J. Ligatti, S.\u00a0R. Rajagopalan, and A.\u00a0Z. Tabari. 2024. A Preliminary Study on Using Large Language Models in Software Pentesting. In Proceedings of the Workshop on SOC Operations and Construction (WOSOC 2024). San Diego, CA, USA, 1\u20137. https:\/\/www.ndss-symposium.org\/wp-content\/uploads\/wosoc2024-2-paper.pdf"},{"key":"e_1_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1109\/icecet61485.2024.10698605"},{"key":"e_1_2_1_51_1","doi-asserted-by":"publisher","unstructured":"G. Siracusano D. Sanvito R. Gonzalez M. Srinivasan S. Kamatchi W. Takahashi M. Kawakita T. Kakumaru and R. Bifulco. 2023. Time for aCTIon: Automated Analysis of Cyber Threat Intelligence in the Wild. arXiv (July 2023). doi: 10.48550\/arXiv.2307.10214","DOI":"10.48550\/arXiv.2307.10214"},{"key":"e_1_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1109\/CNS48642.2020.9162256"},{"key":"e_1_2_1_53_1","unstructured":"J.\u00a0P. Spradley. 2016. Participant Observation. Waveland Press. https:\/\/www.waveland.com\/browse.php?t=689"},{"key":"e_1_2_1_54_1","volume-title":"Proceedings of the 11th Symposium on Usable Privacy and Security (SOUPS)","author":"Sundaramurthy C.","year":"2015","unstructured":"S.\u00a0C. Sundaramurthy, A.\u00a0G. Bardas, J. Case, X. Ou, M. Wesch, J. McHugh, and S.\u00a0R. Rajagopalan. 2015. A Human Capital Model for Mitigating Security Analyst Burnout. In Proceedings of the 11th Symposium on Usable Privacy and Security (SOUPS). Ottawa, Canada, 347\u2013359. https:\/\/www.usenix.org\/system\/files\/conference\/soups2015\/soups15-paper-sundaramurthy.pdf"},{"key":"e_1_2_1_55_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2014.84"},{"key":"e_1_2_1_56_1","volume-title":"Proceedings of the 12th Symposium on Usable Privacy and Security (SOUPS 2016","author":"Sundaramurthy C.","year":"2016","unstructured":"S.\u00a0C. Sundaramurthy, J. McHugh, X. Ou, M. Wesch, A.\u00a0G. Bardas, and S.\u00a0R. Rajagopalan. 2016. Turning Contradictions into Innovations or: How We Learned to Stop Whining and Improve Security Operations. In Proceedings of the 12th Symposium on Usable Privacy and Security (SOUPS 2016). Denver, CO, USA, 237\u2013251. https:\/\/www.usenix.org\/system\/files\/conference\/soups2016\/soups2016-paper-sundaramurthy.pdf"},{"key":"e_1_2_1_57_1","doi-asserted-by":"publisher","DOI":"10.1177\/1098214005283748"},{"key":"e_1_2_1_58_1","doi-asserted-by":"publisher","unstructured":"H. Touvron T. Lavril G. Izacard X. Martinet M.-A. Lachaux T. Lacroix B. Rozi\u00e8re N. Goyal E. Hambro and F. Azhar. 2023. LLaMA: Open and Efficient Foundation Language Models. arXiv (2023). doi: 10.48550\/arXiv.2302.13971","DOI":"10.48550\/arXiv.2302.13971"},{"key":"e_1_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.1093\/isq\/sqab029"},{"key":"e_1_2_1_60_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.findings-acl.121"},{"key":"e_1_2_1_61_1","doi-asserted-by":"publisher","unstructured":"J. Wei X. Wang D. Schuurmans M. Bosma B. Ichter F. Xia E. Chi Q.\u00a0V. Le and D. Zhou. 2022. Chain-of-Thought Prompting Elicits Reasoning in Large Language Models. In Advances in Neural Information Processing Systems Vol.\u00a0 35. 24824\u201324837. doi: 10.5555\/3600270.3602070","DOI":"10.5555\/3600270.3602070"},{"key":"e_1_2_1_62_1","doi-asserted-by":"publisher","DOI":"10.1109\/access.2019.2956831"},{"key":"e_1_2_1_63_1","doi-asserted-by":"publisher","DOI":"10.1145\/3649506"},{"key":"e_1_2_1_64_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.findings-emnlp.891"}],"container-title":["ACM Transactions on Internet Technology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3819819","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,2]],"date-time":"2026-06-02T21:49:43Z","timestamp":1780436983000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3819819"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6,2]]},"references-count":64,"alternative-id":["10.1145\/3819819"],"URL":"https:\/\/doi.org\/10.1145\/3819819","relation":{},"ISSN":["1533-5399","1557-6051"],"issn-type":[{"value":"1533-5399","type":"print"},{"value":"1557-6051","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,6,2]]},"assertion":[{"value":"2025-05-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2026-05-06","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2026-06-02","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}],"article-number":"3819819"}}