Hybrid rule-based and AI-driven architecture for intelligent cyber event routing and filtering

Abstract

Relevance. Security operations centers receive more alerts than analysts can review, many of them false positives. The purpose of the article is to develop and experimentally evaluate a hybrid architecture for cyber event routing that combines rules, machine learning, large language models and analyst validation. Tasks: to formalize a selective routing policy for these components and to compare the architecture with each component used alone. Methods. A rule-based gate resolves events with high or low rule scores; the remaining events are scored by a one-class support vector machine; a language model is consulted only for events near the decision threshold within an invocation budget; disagreements between layers are escalated to an analyst (simulated in the experiments). Scientific novelty. The invocation of each costly component is defined by explicit thresholds, an uncertainty band, a language model budget and analyst capacity, which makes the cost of intelligent processing controllable. Practical significance. The routing policy can serve as a configurable filtering stage in security operations centers. Results. On kernel process events and distributed file system logs, the architecture matched the best standalone detector on each dataset, although the best detector differed between the datasets (rules for kernel events, machine learning for file system logs). Letting the language model decide on uncertain log sessions significantly lowered the F1-score, while the language model alone performed well on kernel events but poorly on file system logs. Conclusions. No statistically significant gain over the best standalone detector was observed; on these data, the language model should support analysts rather than override the other layers.