Noise Pollution is Damaging Your SOC: Prevent IoCs From Turning Into Indication of Cacophony

Noise Pollution is Damaging Your SOC: Prevent IoCs From Turning Into Indication of Cacophony

Speaker: Joey D — Canadian Centre for Cyber Security (CSE)

Conference: NorthSec 2025 — May 15–16, 2025, Marché Bonsecours, Montreal

Watch on YouTube: https://www.youtube.com/watch?v=qq6nw2qhCbk

Reading time: ~7 minutes

TL;DR

Joey D, team lead of a detection engineering team at the Canadian Centre for Cyber Security (CCCS), argues that alert fatigue in Security Operations Centres is not just a tooling problem — it is a data quality and context problem. Using Windows Delivery Optimization (port 7680) as a concrete case study, he demonstrates how a well-framed "20-20" knowledge base entry turns a panic-inducing Friday-afternoon critical alert into a routine triage in under twenty seconds.

Introduction

The Canadian Centre for Cyber Security protects close to one million devices across more than 167 federal, provincial, municipal, and critical-infrastructure clients. At that scale, the numbers are staggering: over 200,000 host events per second flow through sensors, and automated and manual analysis actions roughly three billion network blocks every day. Against that backdrop, even a modest false-positive rate does not mean a few extra tickets — it means entire analyst shifts consumed by noise.

Joey D opens his NorthSec 2025 talk by drawing a deliberate analogy to environmental noise pollution. Just as chronic exposure to excessive sound causes elevated blood pressure, impaired focus, and reduced performance, the relentless stream of unlabelled, de-contextualized alerts degrades a SOC analyst's judgement over time. The result is alert fatigue: the condition where a truly malicious event is lost in a sea of irrelevant notifications. His talk proposes a structured remedy grounded in detection-engineering discipline — and illustrates the entire argument through a single, deceptively mundane Windows feature.

The Pyramid of Pain and Why the Bottom Matters

The classic Pyramid of Pain framework ranks threat intelligence indicators by how costly they are for an adversary to change. IP addresses and domain names sit at the bottom; TTPs sit at the top. Defenders often chase the top of the pyramid because detections there are more durable, but Joey D argues that mature, defence-in-depth SOCs cannot abandon the bottom levels — even when they are noisy.

▶ Watch: Pyramid of Pain and detection maturity (4:00)

Indicator-of-compromise (IoC) based detections are painful precisely because the same data patterns that reveal an attacker also appear in benign traffic. Three structural causes drive most of this noise: deceptive data (wrong telemetry type for the detection goal, such as using NetFlow to detect encrypted web shell activity), missing intelligence context (a fresh fake-CAPTCHA domain that looks malicious but is being accessed from a legitimate user process), and an imbalance of human versus automated activity (automation that fires without sufficient enrichment). Recognising which cause applies to a given noisy rule is the first step toward silencing it without also suppressing genuine detections.

The 20-20 Knowledge Base: A Framework for Triage Speed

The core prescription Joey D offers is the "20-20 definition" — a structured knowledge base entry that must answer three progressive questions for any behavioural detection:

• 20 seconds: What am I looking at? (Identification)
• 2 minutes: How does it work? (Understanding)
• 20 minutes: How would a threat actor abuse it? (Abuse modelling)

▶ Watch: Introducing the 20-20 knowledge base concept (6:01)

Without this structure, even AI-assisted triage tools hallucinate incorrect explanations, as Joey D demonstrates with a live example. A Friday-afternoon critical alert fires: a client's internal host is uploading two gigabytes of data to an IP tagged by the CCCS CTI team as Volt Typhoon infrastructure, over port 7680. Without context, the only defensible options are to escalate immediately or discard the alert — both potentially wrong. The 20-20 approach provides a third option: understand the behaviour first, then decide.

Windows Delivery Optimization: A Case Study in Context

Port 7680 belongs to Windows Delivery Optimization (DO), a peer-to-peer update distribution service enabled by default on Windows 10 and 11. Understanding how DO works is the heart of the case study.

▶ Watch: Delivery Optimization deep dive (8:00)

When a Patch Tuesday update arrives, Microsoft distributes it across a fleet of, say, one million managed devices. Without DO, that would mean 700 terabytes of identical data traversing sensors. With DO, the update is split into equally-sized one-megabyte chunks. Each chunk is downloaded from one of three sources: Microsoft servers, peer devices on the same network, or a Microsoft Connected Cache node. The service runs under svchost using dosvc.dll, is managed by RPC/COM interfaces (functionally similar to BITS), and stores job and swarm metadata in a registry-format file called dosvcdstate.dat.

▶ Watch: DO peer-to-peer mechanics and Join Array API (14:00)

The peer discovery process is particularly interesting from a security standpoint. A device looking for peers calls Microsoft's geo API to identify the nearest datacenter, then hits a key-value endpoint to retrieve configuration, a content-specific policy endpoint to obtain the file's hash-of-hashes (a SHA-256 of the complete update), and a Join Array endpoint that returns roughly 250 potential peers — including their IP addresses and port 7680. If peers share the same public IP as the requesting device, their internal IPs are returned. If not, only external IPs are visible. As Joey D notes, this makes port 7680 traffic function as a kind of passive LAN scanner, a property worth understanding before dismissing — or escalating — every alert it generates.

From Detection Engineer to Mindset Change

The deeper shift Joey D advocates is a change in detection-engineering philosophy: stop trying to detect only what is malicious and start building comprehensive knowledge of what is legitimate.

▶ Watch: Detection mindset and reducing noise pipeline (4:00)

Three levers control noise in a detection pipeline: telemetry quality (capturing the right data type for the detection goal), context richness (enriching alerts with enough information for rapid analyst decision-making), and alert volume (reducing the count of alerts that require manual review before fatigue sets in). The 20-20 knowledge base directly attacks the second lever; investments in better host-based sensors and log collectors address the first; automation with proper guardrails — critically, without allowing automated responses to hallucinate decisions — addresses the third.

This framing reframes the role of detection engineering from reactive rule-writing to proactive environment documentation. Before a detection can be trustworthy, the behaviour it monitors must be thoroughly understood. The Delivery Optimization case study is not merely an interesting technical detour; it is proof of concept that this level of depth is achievable, replicable, and valuable.

Notable Quotes

"Noise pollution causes a lot of pain, and it's resulting in alert fatigue. But to be honest, that noise pollution is caused by pain."

"Detection engineers have to change their mindset from detecting what is malicious to detecting what is legitimate."

"In twenty seconds, [an analyst] should be able to identify the behaviour. In two minutes, they should be able to understand it. In twenty minutes, they should be able to recognise how an actor would abuse that behaviour."

"Assessing the alert without additional information is just wrong."

Key Takeaways

• Alert fatigue is structural, not inevitable. At CCCS scale — 200,000+ host events per second — noise is the expected state unless detection pipelines are deliberately engineered against it.
• The Pyramid of Pain hurts defenders too. IoC-level detections are noisy by nature, but they cannot be abandoned; they must be enriched with context to remain actionable.
• The 20-20 knowledge base is the unit of detection quality. Every detection rule should ship with an entry that enables 20-second identification, 2-minute understanding, and 20-minute abuse modelling.
• Windows Delivery Optimization is a legitimate, high-volume source of port 7680 traffic. Analysts who understand its peer-discovery mechanics can triage DO-related alerts in seconds rather than escalating them unnecessarily.
• Know the legitimate before hunting the malicious. Detection engineering maturity means documenting normal system behaviour thoroughly enough that deviations stand out clearly.