Document Type

Article

Publication Date

8-12-2026

Abstract

Abstract — Modern Security Operations Centers (SOCs) must continuously process massive volumes of heterogeneous security telemetry while meeting stringent throughput, latency, and operational continuity requirements. Although transformer-based artificial intelligence has significantly improved threat detection and alert prioritization, most cybersecurity research evaluates model accuracy rather than the end-to-end behavior of AI-enabled operational pipelines. Consequently, relatively little is known about how heterogeneous CPU–GPU coordination, scheduling overhead, memory movement, and synchronization collectively influence operational SOC performance. This paper presents the AI Cyber First Responder, a heterogeneous SOC triage architecture that integrates GPU-accelerated transformer inference with CPU-based doctrine-driven reasoning to investigate end-to-end pipeline behavior rather than predictive performance alone. Using the publicly available CSE-CIC IDS 2018 dataset transformed into alert-oriented workloads, a controlled experimental study was conducted within a dual-GPU Kaggle environment. Four execution configurations, single-GPU inference, two-GPU data parallel inference, sequential GPU-to-CPU processing, and heterogeneous pipeline overlap, were evaluated across workloads of 100,000, 500,000, and 1,000,000 alerts using microbatch sizes of 64, 128, and 256. Each experiment was repeated five times, with median values reported for throughput, latency, and resource utilization. Contrary to the original hypothesis, sequential GPU to-CPU execution consistently achieved the highest end to-end throughput and lowest latency. Although heterogeneous pipeline overlap outperformed two-GPU data-parallel execution, increased GPU utilization alone did not improve overall pipeline performance. The results indicate that scheduling overhead, synchronization costs, host-device communication, and workload balance exert greater influence on operational efficiency than additional accelerator capacity. Rather than presenting another AI detection model, this work contributes a reproducible systems-oriented framework for analyzing bottlenecks in heterogeneous AI pipelines for SOC triage. The findings establish pipeline coordination as a primary systems challenge for AI enabled cyber defense and provide an experimentally grounded foundation for future research in performance portability, resilient execution, distributed AI systems, and operational cyber defense.

Program or Discipline Name

Computational Sciences

Secondary Program or Discipline Name

Cybersecurity Operations and Control Management

Download

Share

COinS