STRAL: What Adaptation Gains, Loses, and Costs in SOC Alert Screening
STRAL introduces a method for adaptive alert screening in Security Operations Centers by combining a frozen XGBoost screener with dynamic adaptation mechanisms. It uses an ADWIN-based score-shift trigger to detect concept drift and a hybrid acquisition rule that balances sampling based on uncertainty and high predicted scores. The results show this approach maintains low false positive rates while adapting to evolving alert patterns, offering better trade-offs than static methods.