Optimalisasi Intelijen Ancaman Siber di Security Operation Centers dengan Pemanfaatan Large Language Models (LLM) dan SIEM

Abstract

In the era of increasing digital transformation, cyber threats have become a major concern for higher education institutions such as Institut Teknologi Sepuluh Nopember (ITS). Security Operations Center (SOC) plays a crucial role in detecting and responding to security incidents, often supported by Security Information and Event Management (SIEM) systems like Wazuh. However, traditional SIEM systems generate high volumes of alerts, many of which are false positives, causing alert fatigue and slowing incident response. This study explores the integration of Large Language Models (LLM), such as GPT-4 and LLaMA 3, to enhance SOC performance through intelligent triage automation. Using a qualitative descriptive approach based on literature review, this research proposes a conceptual system framework that combines SIEM with LLM as an analytical agent. The designed system features components for alert processing, natural language explanation, automated reporting, and a feedback loop for continuous improvement. The proposed framework is expected to reduce the workload of SOC analysts, improve alert classification accuracy, and accelerate threat response in academic environments.