Predictive incident detection architectural proposal for local AI in SOC

Abstract

The dissolution of the traditional network perimeter and the adoption of zero-trust architectures have inundated modern Security Operations Centers (SOCs) with high-velocity, heterogeneous telemetry, creating highly stochastic environments where Advanced Persistent Threats (APTs) thrive by mimicking benign behavior over extended temporal horizons. Traditional machine learning Intrusion Detection Systems (IDS) rely on monolithic, static models that suffer from severe performance degradation due to continuous concept and feature drift, label scarcity, and structural graph bottlenecks. To resolve these operational gaps, this thesis proposes AEGIS-CT, a highly scalable, self-supervised, and predictive IDS pipeline that mathematically bifurcates the continuous physics of network traffic from the discrete semantic reasoning of attacker intent. The architecture is structured across three specialized phases: Phase 1 standardizes incomplete, mixed-type streaming data into a unified latent space using a Gaussian Copula module and autonomously mitigates structural and semantic drift via an unsupervised detector (ADWIN-U) coupled with Representation Enhancement for Concept Drift Adaptation (ReCDA). Phase 2 contextualizes anomalies by utilizing an Ontology-Grounded Retrieval-Augmented Generation (OG-RAG) framework, mapping telemetry to a strict STIX and AttacKG+ cybersecurity knowledge graph to extract unambiguous, semantic macro-states without relying on numerical data evaluation by Large Language Models (LLMs). Phase 3 integrates these bifurcated payloads into an Episodic Continuous-Time Temporal Graph Neural Network (CT-TGNN). By leveraging Time-Aware Batch-Normalized Ordinary Differential Equations (TA-BN-ODE) and decoupling continuous computation from historical memory via a Global State Registry, the system evaluates temporal network evolution without adjacency matrix memory explosion. Rigorous theoretical evaluation establishes strict mathematical bounds on computational complexity, demonstrating the reduction of point process scaling from O(n2) to O(n3/2). A logical dry-run against the SolarWinds supply-chain compromise validates the pipeline’s theoretical capacity to prevent adversarial drift poisoning, bridge massive temporal dormancy gaps, and translate complex topological deviations into highly explainable, sample-level alerts designed for seamless Human-AI teaming.