Security Operations Centers increasingly use artificial intelligence to rank alerts, summarize evidence, and automate repetitive response actions. However, AI-enabled security operations can also create new risks for incident response and digital forensic reliability, including false-negative prioritization, model drift, hallucinated explanations, prompt injection, automation bias, unsafe SOAR actions, and evidence contamination. This article proposes a risk-driven deployment and forensic readiness framework for AI-enabled Security Operations Centers. The framework combines Monte Carlo loss simulation, detector threshold analysis, analyst queueing, model-drift monitoring, and evidence-preserving governance controls. It explicitly separates evidence, recommendation, and action so that AI can accelerate triage while preserving source artifacts, provenance, audit trails, and chain-of-custody information needed for incident reconstruction. Illustrative simulation results show a mean annualized loss expectancy of USD 1.70 M, a 95% Value-at-Risk of USD 3.85 M and a 99% Value-at-Risk of USD 6.29 M, a detector ROC-AUC of 0.942 and PR-AUC of 0.750 with precision 0.719, recall 0.650 and F1 0.683 at the selected decision threshold of 1.873, a manual triage workload reduction of about 38%, and a reduction in mean time to respond (MTTR, defined throughout as mean time to respond rather than mean time to resolution) from about 44 to 26 min under controlled assumptions. The results are demonstration outputs rather than universal benchmarks. The main contribution is a reproducible governance method for deciding when AI reduces SOC risk, when it transfers risk, and when forensic readiness requires human approval, evidence preservation, or automation rollback.

Passive Wi-Fi localization for critical-infrastructure security operations centers (SOCs) faces three interconnected limitations. First, many existing methods produce single-point coordinate estimates without calibrated uncertainty, making them unsuitable for automated SOC response. Second, localization pipelines often lack an evidentiary chain of custody, limiting reliable post-incident auditability. Third, SOC automation cannot safely rely on uncalibrated confidence values because erroneous high-impact actions and missed escalations carry asymmetric operational costs. This study presents a Blockchain-Enabled Uncertainty-Aware Passive Wi-Fi Localization framework for heterogeneous sensor networks composed of stationary sensors, mobile receivers, and UAV-assisted collection nodes. Instead of producing a single coordinate estimate, the method derives a posterior spatial distribution with calibrated uncertainty from monitor-mode observations, including RSSI aggregates, management/control frame features, channel occupancy indicators, and receiver logs. The framework combines three tightly coupled components: (i) Bayesian coordinate estimation with robust loss functions and range-dependent error modeling; (ii) uncertainty calibration that converts posterior confidence into operational SOC response modes (AUTO, VERIFY, and OBSERVE) via empirical coverage metrics and reliability diagrams; and (iii) a permissioned evidentiary logging layer that anchors integrity-relevant metadata and policy labels on-chain while keeping raw telemetry off-chain for tamper-evident auditability and scalability. The coupling between layers is explicit: calibrated confidence scores govern smart-contract gating conditions, and smart-contract policy thresholds feed back into the calibration stage. Field validation shows that localization performance degrades markedly beyond approximately 40 m, indicating a practical boundary for confident automated action. The proposed framework integrates passive sensing, uncertainty-aware localization, and blockchain-based evidentiary trust for secure critical-infrastructure sensor networks. Its key contributions are: (1) a posterior-distribution-based passive localization pipeline; (2) empirical coverage metrics for calibrating SOC response thresholds; (3) a hybrid on-chain/off-chain architecture linking localization outputs to a permissioned ledger; and (4) field validation establishing the 40 m operational validity boundary.

This article presents practical aspects of correlating Wi-Fi wireless network radio events with cyber events collected by Security Information and Event Management (SIEM) systems, aiming to form a unified incident with spatial attribution and asset context for critical information infrastructure (CII). A unified radio monitoring event schema has been developed that includes source identifiers, RFC 3339 timestamps, radio channel parameters, aggregated frame statistics, source coordinate estimates, and confidence scores. The article describes event enrichment procedures involving zone-of-responsibility mapping, asset criticality assessment, enforcement of applicable access policies, accumulated incident history analysis, and cross-referencing with network access control (NAC) logs, authentication systems, NetFlow/IPFIX network flows, and IDS/IPS alerts. A set of correlation rules has been formulated for rogue AP, evil twin, and deauthentication attack scenarios, where the spatial factor serves as a constraining condition to reduce false positive rates and accelerate the routing of tactical response teams. SOAR playbooks are proposed to automate evidence package formation, responsible party notification, response SLA monitoring, and action logging for audit purposes. It is demonstrated that the proposed integration reduces the mean time to detect (MTTD) and mean time to respond (MTTR) while enhancing incident manageability in protected CII networks. Requirements for APIs and exchange formats are formulated that ensure compatibility with common SIEM and SOAR platforms without modifying their core.

This paper presents a method for detecting False Data Injection (FDI) attacks in Smart Grid state estimation systems based on a Long Short-Term Memory (LSTM) autoencoder. FDI attacks can bypass traditional bad-data detection algorithms based on χ²-statistics and pose a direct threat to accurate state estimation. The proposed method combines passive PMU/WAMS telemetry monitoring with an LSTM autoencoder model for anomaly detection in state vector time series of cyber-physical systems. The theoretical model was evaluated on the open-source HIL-based Augmented ICS (HAI) Security Dataset and synthetic FDI attack scenarios modeled on the IEEE 14-Bus topology. Simulated results demonstrate a detection accuracy of 97.3%, an F1-score of 0.961, and detection latency below 3 seconds at a false alarm rate under 2.1%. The proposed approach outperforms baseline methods (SVM, Random Forest, standalone Autoencoder). The scientific novelty lies in applying an adaptive reconstruction error threshold for the LSTM autoencoder that accounts for temporal dependencies in PMU telemetry measurements, thereby enhancing robustness against intentional evasion.

Cloud integration can be economically attractive yet operationally unsuitable when dependent services exchange traffic over constrained network paths. This study develops a network-aware extension of a time-dependent, three-objective integration model and specifies a cognitive architecture for admitting, deferring, or escalating Pareto-based decisions. Strategic portfolio selection is separated from operational routing; infrastructure and service-dependency graphs connect both levels. The central mechanism evaluates whether the recommended action remains consistent across explicitly defined uncertainty scenarios, while independently checking service constraints, telemetry quality, authorization, and execution budgets. Numerical evidence is separated into an established synthetic portfolio benchmark, an independent reconstruction from its published inputs, and new deterministic network and admission-rule fixtures. Enumeration of the 18-system benchmark confirms 83,657 feasible portfolios and 446 nondominated solutions. Reanalysis of 30 paired run records preserves the original qualitative trade-off: a reference-direction NSGA-III-type baseline improves IGD+ and exact-front coverage, whereas NSGA-II uses less recorded CPU time. This comparison is a secondary reanalysis of offline optimizer records, not a measurement of real-time performance. A new three-service, two-route fixture contains 16 configurations, of which three satisfy the network-aware requirements; an additive compromise using the default route violates the specified end-to-end delay bound. A seeded stress test over 2547 synthetic instances, built from three service-dependency graph families on networks of two or three parallel logical routes between a local and a cloud domain, with traffic shifts, congestion, and route failures, reproduces this effect beyond the single fixture. A nine-scenario admission test yields recommendation agreement of 2/3, correctly withholding an automatic action at a threshold of 0.8, while a narrowed three-scenario set yields full agreement. These are deterministic model-based checks, not measured improvements in a deployed network; no trained predictor, emulation, or closed-loop controller is evaluated. The contribution is therefore formal and computational: an auditable connection between portfolio optimization, service dependencies, and decision-specific uncertainty. A separately identified evaluation protocol defines the learning, telemetry, ablation, and real-traffic evidence still required to establish closed-loop effectiveness.