Search papers, labs, and topics across Lattice.
The paper introduces PACT, a Pareto-aware controller for triggered active learning, designed to reduce alert fatigue in security operations centers dealing with low-prevalence event streams. PACT adaptively shifts the scoring window of a frozen XGBoost-Focal screener and uses a hybrid acquisition rule to balance uncertainty and high-score sampling for analyst queries. Results on AIT-ADS and BOTSv1 benchmarks show PACT significantly reduces benign-normalized false-positive burden compared to frozen baselines and uniform-random updating, while maintaining acceptable recall.
Triggered active learning slashes SOC alert fatigue by 43% while dramatically reducing analyst query load, proving that smart sampling beats brute-force retraining.
Security operations centers face persistent alert fatigue: in low-prevalence streams, even low false-positive rates generate substantial investigation load, while aggregate F1 scores obscure analyst burden. We introduce PACT, a Pareto-aware controller for triggered active learning, which wraps an already-deployed frozen XGBoost-Focal screener with an adaptive windowing score-shift trigger and a hybrid acquisition rule combining threshold-relative uncertainty with high-score sampling. On two public low-prevalence benchmarks, AIT-ADS (AIT Alert Data Set), and BOTSv1 (Boss of the SOC version 1), PACT attains the lowest benign-normalized false-positive (FP) burden among the adaptive methods tested. It reduces burden by 43% and 21%, respectively, relative to a frozen baseline, while using 3.8x and 5.2x fewer analyst queries than periodic uniform-random updating. A matched-trigger ablation controls trigger timing and shows that acquisition contributes beyond timing alone, at the cost of approximately ten percentage points of positive-window recall under free-running triggers. A frozen threshold-only baseline pushes FP lower still but collapses BOTSv1 recall by 55 percentage points. Under the evaluated workload assumptions, pure FP minimization trades unacceptable recall for that lower burden.
