STRAL: What Adaptation Gains, Loses, and Costs in SOC Alert Screening

Abstract

Security-alert screening must balance false-alert burden against missed important events, yet adaptation can change which events are detected. We investigate this trade-off using STRAL, a score-triggered active-learning controller combining ADWIN monitoring, selective label acquisition, and bounded model updates, with an optional historical validation Guard. Across four chronological alert-stream settings, we compare adaptive screening with a fixed, non-adapting baseline (Frozen), measuring recall, false-alert burden, detection preservation, and label-query costs. On two AMiner settings, STRAL reduces false positives by 21.4% (14 to 11) and 16.7% (6 to 5), respectively, while preserving all Frozen detections. On Wazuh, Guard reduces false positives by 9.8% (522 to 471), while losing two Frozen detections. On NAD-CD, STRAL raises recall from 36.11% to 40.29%, but loses 40.1% of Frozen detections while gaining 3,000 others; false positives increase by 151.2%. Guard preserves Frozen decisions on NAD-CD but requires 3,550 label queries, compared with 2,000 for STRAL. These findings demonstrate why adaptive SOC screening must be evaluated through detection preservation, false-alert burden, and feedback cost alongside aggregate recall.

arXiv comment11 pages, 4 figures, 8 tables. v2: PACT renamed STRAL to avoid a naming collision. Substantially revised model selection, threshold calibration, and empirical evaluation, including AMiner, Wazuh/AIT-ADS, NAD-CD, Guard, detection turnover, acquisition comparisons, classifier transfer, and sensitivity analyses. Earlier BOTSv1 and focal-loss results remain in v1