AI-DRIVEN INCIDENT CLASSIFICATION: DESIGN AND EVALUATION OF A SYSTEM FOR SOC OPERATIONS UNDER THE TC-ACN FRAMEWORK

The increasing volume and complexity of cyber threats have placed a significant load on Security Operations Center (SOC) analysts, who must guarantee rapid response times while maintaining high reporting standards. In the Italian cybersecurity landscape, the transition to the NIS2 Directive and the adoption of the national TC-ACN framework require precise incident classification for notification and regulatory compliance. This thesis proposes the design and evaluation of an AI- driven system developed to automate the mapping of security events according to the TC-ACN taxonomy. The proposed architecture employs a hybrid approach: a deterministic rule-based engine handles known event patterns, while an advanced Natural Language Processing (NLP) model classifies more unstructured and ambiguous incident descriptions. The work is structured to provide a design section followed by an experimental evaluation. Using metrics like Accuracy and F1-Score, the system shows it can effectively simplify the triage process and help analysts work better, reducing the Mean Time to Respond (MTTR). Overall, this study offers a solution to align operational SOC activities with national regulatory mandates, ensuring correct compliance within the Italian cybersecurity ecosystem.