PACT: Pareto-Aware Active Learning Cuts SOC Alert Fatigue in Low-Prevalence Security Streams

arXiv·medium signal

PACT wraps a frozen XGBoost screener with an adaptive windowing score-shift trigger and a hybrid acquisition rule to reduce false-positive investigation load in security operations centers. In low-prevalence alert streams, even low FPR rates generate substantial analyst burden, but aggregate F1 scores obscure this. The system uses triggered active learning — only requesting analyst labels when drift is detected — achieving better precision-recall tradeoffs without retraining the base model.