Real-Time Log Analysis and Automated Threat Detection for Cybersecurity

Abstract

Security Operations Centres (SOCs) act as the nerve centre of an organization’s cyber-defence strategy, bringing together people, processes, and technology to watch over digital infrastructure around the clock. As enterprises expand their networks and adopt cloud, mobile, and IoT-connected systems, the volume of security-relevant events generated every day has grown far beyond what analysts can review manually. This escalation makes real-time, automated monitoring not just useful but necessary, since delays in identifying malicious activity can translate directly into data breaches, financial loss, and reputational damage. The project set out to address this gap by building a practical, real-time monitoring and threat-detection workflow that could be deployed on common Windows/Linux environments without requiring specialised or expensive infrastructure. At the core of the proposed work is a Security Information and Event Management (SIEM) approach that continuously ingests logs from authentication services, operating systems, applications, and network devices, then normalises and correlates them to surface patterns indicative of compromise. Particular emphasis is placed on authentication behaviour, since repeated failed logins, brute-force attempts, and unauthorized access are among the earliest and most reliable indicators of an ongoing attack. By combining structured log collection with rule-based correlation, the system is able to separate routine, benign activity from genuinely suspicious behaviour, generate timely alerts, and compile investigation-ready reports. The resulting framework demonstrates that even a lightweight, rule-driven SIEM pipeline can meaningfully strengthen SOC operations, while also laying the groundwork for future enhancement through machine learning, artificial intelligence, and large language model-based analysis.