Semi-supervised learning in Security Operations Centers: Performance, trade-offs and practical implications

Security Operations Centers (SOCs) are under constant pressure to reduce the time required for detecting and responding to cyber threats. To support this objective, machine learning (ML) has become an increasingly valuable tool. This benchmark study explores the potential of semi-supervised learning (SSL) techniques to enhance ML performance in critical SOC tasks, including intrusion detection, malware classification, and alert handling. Five representative SSL methods, namely, self-learning, co-training, active learning, label propagation, and label spreading, are evaluated across seven diverse datasets and compared against supervised baselines. These methods make use of the unlabeled data pool in distinct ways: self-learning, co-training, and graph-based approaches extract learning signals directly from unlabeled instances, whereas active learning leverages the unlabeled pool to identify which samples should be selected for annotation. The analysis also considers key challenges related to the training data, such as limited labeled samples, labeling errors, and class imbalance. Beyond predictive performance, SSL approaches are also compared on the basis of training time and energy consumption. The results demonstrate that active learning can significantly improve detection capabilities while substantially reducing the labeling workload for human analysts, making them a promising direction for SOC automation and efficiency.