STRAL: What Adaptation Gains, Loses, and Costs in SOC Alert Screening
Security-alert screening must balance false-alert burden against missed important events, yet adaptation can change which events are detected. We investigate this trade-off using STRAL, a score-triggered active-learning controller combining ADWIN monitoring, selective label acquisition, and bounded model updates, with an optional historical validation Guard. Across four chronological alert-stream settings, we compare adaptive screening with a fixed, non-adapting baseline (Frozen), measuring recall, false-alert burden, detection preservation, and label-query costs. On two AMiner settings, STRAL reduces false positives by 21.4% (14 to 11) and 16.7% (6 to 5), respectively, while preserving all Frozen detections. On Wazuh, Guard reduces false positives by 9.8% (522 to 471), while losing two Frozen detections. On NAD-CD, STRAL raises recall from 36.11% to 40.29%, but loses 40.1% of Frozen detections while gaining 3,000 others; false positives increase by 151.2%. Guard preserves Frozen decisions on NAD-CD but requires 3,550 label queries, compared with 2,000 for STRAL. These findings demonstrate why adaptive SOC screening must be evaluated through detection preservation, false-alert burden, and feedback cost alongside aggregate recall.