Drift-Aware Explainable Online Learning for Real-Time SIEM Alert Prioritization in Financial Security Operations Centers

Abstract

Security Information and Event Management (SIEM) platforms aggregate heterogeneous telemetry from authentication services, endpoints, firewalls, VPN gateways, cloud identity platforms, and privileged-access controls. In financial Security Operations Centers (SOCs), these streams are non-stationary: remote-access policies, cloud migrations, software updates, seasonal workloads, and adversarial behavior can alter log distributions and degrade static classifiers. This study develops and evaluates a drift-aware, explainable online-learning framework for real-time SIEM alert prioritization. A chronologically ordered six-month dataset contains 12,480,000 raw log events, 8,760,000 cleaned usable events, 124,500 alert-level records, and 2,430 analyst-validated suspicious incidents. The framework integrates online anomaly detection, concept-drift monitoring, separation of benign operational, malicious behavioral, and adversarial drift, SHAP-based explanation, and risk-based alert prioritization. The proposed model achieves precision of 0.88, recall of 0.84, F1-score of 0.86, ROC-AUC of 0.94, PR-AUC of 0.78, and a false-positive rate of 5.2%. During drift windows, performance declines by 5.7%, compared with 21.2% for static XGBoost and 22.7% for static Random Forest. The weighted F1-score for drift separation is 0.85. These findings indicate that controlled online adaptation, explanation-stability monitoring, and risk-aware ranking can improve detection robustness and analyst decision support under evolving financial-sector threat conditions.