Human-Aware Next-Generation SOCs: A Machine Learning-Based Decision Model for Sustainable Threat Detection and Prevention

Abstract

Security Operations Centers (SOCs) increasingly face alert overload, analyst fatigue, and difficulties i n maintaining effective threat prioritization under high-volume cyber environments. While machine learning-based intrusion detection systems achieve strong detection performance, most approaches insufficiently c o nsider o p erational c o nstraints s u ch a s analys workload, confidence re liability, and ad aptive decision-making. This paper proposes a human-aware adaptive SOC decision framework integrating calibrated machine learning, workloadaware triage, Q-learning-based threshold selection, and SHAPbased explainability. The proposed approach combines XGBoost with isotonic calibration to improve probability reliability and uses adaptive thresholding to support alert prioritization under simulated SOC workload conditions. Experimental results on the UNSW-NB15 dataset achieve an F1-score of approximately 0.936, a ROC-AUC of 0.999, and a PR-AUC of 0.989, while reducing analyst workload by about 95% compared with static escalation. Calibration analysis reduces the Expected Calibration Error (ECE) from 0.0111 to 0.0003, confirming i m proved confidence reliability. SHAP-based explanations further show that the model relies on meaningful network indicators, supporting transparent SOC decision-making. The results suggest that combining calibrated detection, adaptive workload-aware triage, and explainability can improve SOC operational efficiency while preserving detection effectiveness.