{"id":"https://openalex.org/W7225761238","doi":"https://doi.org/10.48175/ijarsct-40740","title":"An Isolation Forest\u2013Driven SOC Framework for Multi-Source Security Event Analysis and Human-Governed Automated Response","display_name":"An Isolation Forest\u2013Driven SOC Framework for Multi-Source Security Event Analysis and Human-Governed Automated Response","publication_year":2026,"publication_date":"2026-11-10","ids":{"openalex":"https://openalex.org/W7225761238","doi":"https://doi.org/10.48175/ijarsct-40740"},"language":"en","primary_location":{"id":"doi:10.48175/ijarsct-40740","doi":"https://doi.org/10.48175/ijarsct-40740","is_oa":true,"landing_page_url":"https://doi.org/10.48175/ijarsct-40740","pdf_url":"https://doi.org/10.48175/ijarsct-40740","source":{"id":"https://openalex.org/S4210201094","display_name":"International Journal of Advanced Research in Science Communication and Technology","issn_l":"2581-9429","issn":["2581-9429"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/P4376906117","host_organization_name":"Shivkrupa Publication's","host_organization_lineage":["https://openalex.org/P4376906117"],"host_organization_lineage_names":["Shivkrupa Publication's"],"type":"journal"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Advanced Research in Science Communication and Technology","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://doi.org/10.48175/ijarsct-40740","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5161403492","display_name":"Doke Siddharth Mahesh Gade Kuldeep Sunil","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4405262704","display_name":"Jaihind College of Engineering","ror":"https://ror.org/04rftj768","country_code":"IN","type":"education","lineage":["https://openalex.org/I4405262704"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"Gade Kuldeep Sunil, Doke Siddharth Mahesh","raw_affiliation_strings":["Jaihind College of Engineering Kuran, India"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Jaihind College of Engineering Kuran, India","institution_ids":["https://openalex.org/I4405262704"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5161403468","display_name":"Prof. Bhosale Sachin Bajirao Kalekar Anuraj Santosh","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4405262704","display_name":"Jaihind College of Engineering","ror":"https://ror.org/04rftj768","country_code":"IN","type":"education","lineage":["https://openalex.org/I4405262704"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"Kalekar Anuraj Santosh, Prof. Bhosale Sachin Bajirao","raw_affiliation_strings":["Jaihind College of Engineering Kuran, India"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Jaihind College of Engineering Kuran, India","institution_ids":["https://openalex.org/I4405262704"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I4405262704"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"281","last_page":"281"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12391","display_name":"Artificial Immune Systems Applications","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[],"concepts":[{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6812000274658203},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6660000085830688},{"id":"https://openalex.org/C177212765","wikidata":"https://www.wikidata.org/wiki/Q627335","display_name":"Workflow","level":2,"score":0.5375999808311462},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.5205000042915344},{"id":"https://openalex.org/C77714075","wikidata":"https://www.wikidata.org/wiki/Q5452017","display_name":"Firewall (physics)","level":5,"score":0.5123000144958496},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.5105999708175659},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4999000132083893},{"id":"https://openalex.org/C2776654903","wikidata":"https://www.wikidata.org/wiki/Q2601463","display_name":"SAFER","level":2,"score":0.48159998655319214},{"id":"https://openalex.org/C115901376","wikidata":"https://www.wikidata.org/wiki/Q184199","display_name":"Automation","level":2,"score":0.4401000142097473},{"id":"https://openalex.org/C2775941552","wikidata":"https://www.wikidata.org/wiki/Q25212305","display_name":"Isolation (microbiology)","level":2,"score":0.41519999504089355},{"id":"https://openalex.org/C195518309","wikidata":"https://www.wikidata.org/wiki/Q13424265","display_name":"Security testing","level":5,"score":0.35690000653266907},{"id":"https://openalex.org/C103377522","wikidata":"https://www.wikidata.org/wiki/Q3493999","display_name":"Security information and event management","level":4,"score":0.3517000079154968},{"id":"https://openalex.org/C2780741293","wikidata":"https://www.wikidata.org/wiki/Q4818019","display_name":"Attack patterns","level":3,"score":0.33379998803138733},{"id":"https://openalex.org/C200749887","wikidata":"https://www.wikidata.org/wiki/Q1165574","display_name":"System monitoring","level":2,"score":0.32580000162124634},{"id":"https://openalex.org/C121822524","wikidata":"https://www.wikidata.org/wiki/Q5157582","display_name":"Computer security model","level":2,"score":0.31380000710487366},{"id":"https://openalex.org/C178148461","wikidata":"https://www.wikidata.org/wiki/Q1632136","display_name":"Security controls","level":3,"score":0.3068000078201294},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.305400013923645},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.30410000681877136},{"id":"https://openalex.org/C27061796","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion prevention system","level":3,"score":0.28369998931884766},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.2782000005245209},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.2685000002384186},{"id":"https://openalex.org/C33499554","wikidata":"https://www.wikidata.org/wiki/Q1417134","display_name":"Dashboard","level":2,"score":0.26179999113082886},{"id":"https://openalex.org/C83163435","wikidata":"https://www.wikidata.org/wiki/Q3954104","display_name":"Security management","level":2,"score":0.2590000033378601},{"id":"https://openalex.org/C38369872","wikidata":"https://www.wikidata.org/wiki/Q7445009","display_name":"Security analysis","level":2,"score":0.2540000081062317},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.2522999942302704},{"id":"https://openalex.org/C29983905","wikidata":"https://www.wikidata.org/wiki/Q7445066","display_name":"Security service","level":3,"score":0.2515999972820282}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48175/ijarsct-40740","doi":"https://doi.org/10.48175/ijarsct-40740","is_oa":true,"landing_page_url":"https://doi.org/10.48175/ijarsct-40740","pdf_url":"https://doi.org/10.48175/ijarsct-40740","source":{"id":"https://openalex.org/S4210201094","display_name":"International Journal of Advanced Research in Science Communication and Technology","issn_l":"2581-9429","issn":["2581-9429"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/P4376906117","host_organization_name":"Shivkrupa Publication's","host_organization_lineage":["https://openalex.org/P4376906117"],"host_organization_lineage_names":["Shivkrupa Publication's"],"type":"journal"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Advanced Research in Science Communication and Technology","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.48175/ijarsct-40740","doi":"https://doi.org/10.48175/ijarsct-40740","is_oa":true,"landing_page_url":"https://doi.org/10.48175/ijarsct-40740","pdf_url":"https://doi.org/10.48175/ijarsct-40740","source":{"id":"https://openalex.org/S4210201094","display_name":"International Journal of Advanced Research in Science Communication and Technology","issn_l":"2581-9429","issn":["2581-9429"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/P4376906117","host_organization_name":"Shivkrupa Publication's","host_organization_lineage":["https://openalex.org/P4376906117"],"host_organization_lineage_names":["Shivkrupa Publication's"],"type":"journal"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Advanced Research in Science Communication and Technology","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7225761238.pdf","grobid_xml":"https://content.openalex.org/works/W7225761238.grobid-xml"},"referenced_works_count":20,"referenced_works":["https://openalex.org/W3085865982","https://openalex.org/W3111749540","https://openalex.org/W4226139221","https://openalex.org/W4387886031","https://openalex.org/W4390605115","https://openalex.org/W4391944556","https://openalex.org/W4394586044","https://openalex.org/W4394862991","https://openalex.org/W4396605089","https://openalex.org/W4399146352","https://openalex.org/W4401567266","https://openalex.org/W4403094304","https://openalex.org/W4403094383","https://openalex.org/W4406457647","https://openalex.org/W4406755163","https://openalex.org/W4409882847","https://openalex.org/W4412030684","https://openalex.org/W4413847057","https://openalex.org/W7165671165","https://openalex.org/W7214073483"],"related_works":[],"abstract_inverted_index":{"Modern":[0],"organizations":[1],"generate":[2],"large":[3],"volumes":[4],"of":[5,133,149],"security":[6,16,19,44,74],"events":[7,75],"from":[8],"servers,":[9],"endpoints,":[10],"firewalls,":[11],"intrusion":[12],"detection":[13,177],"systems,":[14],"and":[15,26,37,54,61,65,72,78,83,108,122,141,179,182],"applications.":[17],"Traditional":[18],"monitoring":[20,132],"mainly":[21],"depends":[22],"on":[23],"predefined":[24],"rules":[25],"manual":[27],"investigation,":[28],"which":[29],"can":[30,155],"result":[31],"in":[32],"alert":[33],"fatigue,":[34],"delayed":[35],"response,":[36],"difficulty":[38],"identifying":[39],"abnormal":[40],"behavior":[41],"across":[42],"multiple":[43],"sources.":[45],"This":[46],"research":[47],"proposes":[48],"an":[49],"AI-Based":[50],"Intrusion":[51],"Detection":[52],"System":[53],"Automated":[55],"Response":[56,66],"platform":[57],"using":[58],"Machine":[59,95],"Learning":[60],"Security":[62,90],"Orchestration,":[63],"Automation":[64],"(SOAR).":[67],"The":[68,112,168],"proposed":[69,169],"system":[70,113,170],"collects":[71],"analyzes":[73],"through":[76],"Wazuh":[77],"integrates":[79],"Snort,":[80],"UFW,":[81],"honeypot,":[82],"Gophish":[84],"components":[85],"to":[86,104,172],"create":[87],"a":[88,157],"practical":[89],"Operations":[91],"Center":[92],"(SOC)":[93],"environment.":[94],"Learning,":[96],"particularly":[97],"Isolation":[98],"Forest-based":[99],"anomaly":[100],"detection,":[101],"is":[102,163],"used":[103],"analyze":[105],"security-event":[106],"features":[107],"identify":[109],"suspicious":[110],"behavior.":[111],"also":[114],"performs":[115],"attack":[116],"classification,":[117],"severity":[118],"assessment,":[119],"event":[120],"correlation,":[121],"controlled":[123],"automated":[124,151],"remediation.":[125],"A":[126],"web-based":[127],"SOC":[128],"dashboard":[129],"provides":[130],"real-time":[131],"threats,":[134],"attacker":[135],"IPs,":[136],"ML":[137],"scores,":[138],"firewall":[139],"actions,":[140],"pending":[142],"analyst":[143,161],"reviews.":[144],"To":[145],"reduce":[146,173],"the":[147],"risk":[148],"incorrect":[150],"blocking,":[152],"critical":[153],"responses":[154],"follow":[156],"Human-in-the-Loop":[158],"workflow":[159],"where":[160],"approval":[162],"required":[164],"before":[165],"sensitive":[166],"actions.":[167],"aims":[171],"alert-analysis":[174],"effort,":[175],"improve":[176],"capability,":[178],"provide":[180],"faster":[181],"safer":[183],"incident":[184],"response.":[185]},"counts_by_year":[],"updated_date":"2026-11-11T12:16:26.678958","created_date":"2026-11-11T00:00:00"}