Executive Summary

The Computer System Department at Universitas Tanjungpura's Faculty of Mathematics and Natural Science proposes establishing a MINI SOC (Security Operations Center) powered by AWS cloud infrastructure. This initiative will protect our academic journal system (jurnal.untan.ac.id) serving researchers, academics, and students across Indonesia.

This 12-month project leverages AWS Bedrock and SageMaker for continuous threat detection, combined with a comprehensive Explainable AI (XAI) framework using SHAP, LIME, and DiCE analysis methods. This multi-method approach ensures that security teams can understand and validate every AI decision from multiple perspectives.

The integration of multiple XAI techniques is critical for a SOC environment, where analysts need deep understanding of threat classifications. SHAP provides feature importance, LIME offers local interpretability, and DiCE generates counterfactual explanations - together forming a complete explainability framework.

Problem Statement

Academic journals are increasingly targeted by cyber attacks, including SQL injection, cross-site scripting (XSS), DDoS attempts, and credential stuffing. These attacks can compromise sensitive research data, disrupt service availability, and damage institutional reputation.

Traditional security solutions are reactive and signature-based, failing to detect novel attack patterns or zero-day exploits. They also lack explainability, making it difficult for security teams to understand why certain traffic is flagged as malicious.

Our current infrastructure generates over 1 million security events daily from network flows (Mikrotik NetFlow) and web access logs (Nginx). Manual analysis is impossible, and existing tools provide limited intelligence.

Impact on Academic Mission

Security incidents directly affect our ability to serve the academic community. Downtime disrupts peer review processes, manuscript submissions, and research dissemination. Data breaches could expose confidential author information and unpublished research. We need an intelligent, proactive security system that scales with our growing user base.

Proposed Solution: AWS-Powered MINI SOC

We propose establishing a MINI SOC (Security Operations Center) built on AWS infrastructure, leveraging cloud-native machine learning services for continuous threat detection and multi-method explainable AI analysis over a 12-month period. This MINI SOC will serve as a centralized security intelligence hub for our academic infrastructure.

MINI SOC Architecture

Our MINI SOC architecture consists of four integrated layers:

1. Data Collection Layer (On-Premise)

Network flows (Mikrotik NetFlow) and application logs (Nginx) collected from production systems and securely streamed to AWS for centralized analysis.

2. AWS Storage & Processing Layer

• S3: Centralized log repository with lifecycle policies and archival storage
• Lambda: Serverless orchestration for real-time analysis triggers
• Scalable infrastructure supporting 1M+ daily events

3. AI/ML Analysis Layer

• AWS Bedrock: Primary AI engine for continuous threat analysis and pattern recognition
• SageMaker: Custom model training, fine-tuning, and specialized ML workloads
• Daily processing of all security events with adaptive learning

4. Multi-Method Explainable AI Layer

• SHAP, LIME, and DiCE analysis computed in AWS for every threat detection
• Multiple perspectives on feature importance and decision rationale
• Transparent decision-making for SOC team validation and response

AWS Services Utilization

This project requires sustained use of multiple AWS services throughout the 12-month grant period:

Explainable AI: Multi-Method XAI Framework

A critical component of our MINI SOC is the integration of a comprehensive Explainable AI (XAI) framework combining three complementary methods: SHAP, LIME, and DiCE. This multi-method approach ensures that security teams can understand AI decisions from multiple perspectives, building trust and enabling effective response.

Why Multi-Method XAI Matters for SOC Operations

Traditional machine learning models make predictions without explaining their reasoning. For a Security Operations Center (SOC), this lack of transparency is problematic:

• Security analysts cannot validate AI decisions
• False positives waste investigation time
• Teams cannot learn from AI insights to improve detection rules
• Compliance and audit requirements demand explainability

Our multi-method XAI framework solves this by providing three distinct but complementary perspectives on every threat classification, making AI decisions fully transparent and actionable.

The Three XAI Methods

1. SHAP (SHapley Additive exPlanations)

Purpose: Global feature importance and contribution analysis

SHAP quantifies how much each feature (IP reputation, request pattern, user agent, etc.) contributed to the threat classification. It provides a mathematically rigorous attribution based on game theory, showing both positive and negative contributions across the entire dataset.

What SOC Team Learns:

• Which features are most important overall for threat detection
• How features combine to reach classification decisions
• Baseline comparison showing how current patterns differ from normal

2. LIME (Local Interpretable Model-agnostic Explanations)

Purpose: Local, instance-specific explanations

LIME explains individual predictions by approximating the model locally around a specific instance. For each flagged request, it shows which features were most important for that specific case, even if global patterns differ.

What SOC Team Learns:

• Why this specific request was flagged (not just general patterns)
• Local feature importance that may differ from global trends
• Edge cases and unusual attack patterns that don't fit standard profiles

3. DiCE (Diverse Counterfactual Explanations)

Purpose: Counterfactual reasoning and what-if analysis

DiCE generates alternative scenarios showing what would need to change for the classification to flip. For a malicious request, it shows: "If the IP had been from a trusted range, OR if the request pattern matched normal behavior, the classification would have been benign."

What SOC Team Learns:

• What minimal changes would make a threat benign (helps validate true positives)
• Multiple paths to the same classification (robustness check)
• Understanding decision boundaries and model confidence

Complementary Benefits of Multi-Method XAI

Project Sustainability & Job Continuity

A critical aspect of this proposal is long-term sustainability. The 12-month AWS credits period is not just for operation, but for building sustainable capabilities that continue beyond the grant period.

Sustainability Strategy: 90% Cost Reduction After Year 1

During the 12-month period, we will train and refine models using AWS infrastructure. By the end of this period, we will have:

• Fine-tuned threat detection model exported from AWS SageMaker
• Comprehensive baseline of normal traffic patterns (90 days)
• Trained SOC team capable of operating and maintaining the system
• Complete XAI framework (SHAP+LIME+DiCE) integrated and tested

Post-Grant Operation Model

After obtaining the trained model from AWS, threat detection will shift to on-premise infrastructure:

1. On-Premise Inference (90% of traffic)

• Exported model runs locally using Ollama or similar open-source inference engine
• Known attack patterns detected instantly with zero AWS cost
• XAI explanations computed locally for standard threats

2. Selective Cloud Processing (10% of traffic)

• Only novel patterns unrecognized by local model sent to AWS
• Incremental logs for edge cases analyzed with AWS Bedrock
• Model updates quarterly instead of daily

3. Continuous Learning Loop

• New attack patterns discovered locally are batched and sent for analysis
• Quarterly model refresh cycles using accumulated new patterns
• Knowledge base grows over time without continuous cloud dependency

Cost Comparison: Year 1 vs Year 2+

Budget Justification

We request $20,000 in AWS credits to support continuous operation of this MINI SOC system for 12 months. Cost estimates are based on processing 1 million security events per day with real-time AI analysis and comprehensive XAI computation.

Why AWS Credits Are Critical: As an academic institution, we lack the budget to sustain commercial pricing for enterprise AI services. AWS credits enable us to implement state-of-the-art security using Bedrock and SageMaker, protecting our research community while building sustainable long-term capabilities. The 12-month period allows us to train models, establish baselines, and transition to cost-effective on-premise operation.

Expected Outcomes & Benefits

Operational MINI SOC

A fully functional Security Operations Center capability, even with limited resources. Centralized threat monitoring, analysis, and response for all academic infrastructure.

Multi-Method Explainable AI

Every threat detection accompanied by SHAP, LIME, and DiCE analysis providing comprehensive explainability. SOC team can validate, learn from, and trust AI recommendations from multiple complementary perspectives.

Enhanced Security Posture

Real-time threat detection with 1M+ daily events analyzed. Immediate response to SQL injection, XSS, DDoS, and novel attack patterns. Reduced dwell time from days to minutes.

Long-Term Sustainability

After 12 months, 90% cost reduction through on-premise inference. Campus budget can sustain ongoing operations at $180-280/month, ensuring job continuity for SOC staff and continuous protection indefinitely.

Research Contribution

Implementation findings will contribute to academic knowledge in applied machine learning for cybersecurity, multi-method XAI frameworks, and sustainable SOC models for resource-constrained institutions.

Institutional Capability Building

SOC team training on AWS services, machine learning operations (MLOps), multi-method XAI interpretation (SHAP+LIME+DiCE), and cloud security best practices. Long-term capability enhancement for the department with guaranteed job continuity.

Implementation Timeline

Conclusion

This proposal presents a compelling use case for AWS credits to establish a MINI SOC that protects critical academic infrastructure. The Computer System Department at Universitas Tanjungpura is committed to leveraging AWS cloud services to build modern, intelligent, and sustainable security capabilities.

By combining AWS Bedrock's continuous threat analysis with a comprehensive multi-method XAI framework (SHAP+LIME+DiCE), we will implement a transparent AI system that security teams can understand, validate, and trust. This explainable AI approach is essential for academic institutions where accountability and understanding matter as much as detection accuracy.

The 12-month grant period with a budget of $20,000 will allow us to:

• Establish a fully operational MINI SOC for academic infrastructure
• Process and analyze 1M+ security events daily with AWS Bedrock
• Provide comprehensive explainable AI insights through SHAP+LIME+DiCE
• Build institutional expertise in AWS services and multi-method XAI
• Achieve 90% cost reduction after year 1 through on-premise inference
• Ensure job continuity for SOC team with sustainable campus funding
• Contribute research findings to the academic cybersecurity community

We are committed to maximizing the impact of AWS credits through rigorous implementation, continuous monitoring, and knowledge sharing. Our findings and methodologies will be published to benefit other institutions facing similar security challenges, particularly in establishing cost-effective MINI SOCs for academic environments.

Contact Information