REFINE: A Resilient Evolution Framework for Intelligent Enterprise Alert Triage in Security Operations Centers

arXiv:2609.32516 · cs.CR, cs.AI, cs.LG · Submitted 2026-09-26 · Read on arXiv

cs.CR, cs.AI, cs.LG

Submitted: 2026-09-26

Updated: 2026-09-26

Code: https://github.com/openai/tiktoken

Terminology

• Accuracy — 59× in this paper · explained in 1 episode
• Core — 10× in this paper · explained in 2 episodes
• Alignment — 9× in this paper · explained in 1 episode
• Large Language Model — 6× in this paper
• Ablation — 5× in this paper · explained in 1 episode
• Alert Fatigue — 5× in this paper · explained in 1 episode
• Generalization — 4× in this paper · explained in 13 episodes
• Decoupling — 3× in this paper · explained in 2 episodes
• Reinforcement Learning — 3× in this paper · explained in 4 episodes
• Robustness — 3× in this paper · explained in 5 episodes
• Verification — 3× in this paper · explained in 2 episodes
• Aggregation — 2× in this paper · explained in 1 episode
• Failure Modes — 2× in this paper · explained in 3 episodes
• Ablation study — 1× in this paper · explained in 1 episode
• Active Learning — 1× in this paper · explained in 6 episodes
• Calibration — 1× in this paper · explained in 7 episodes
• Consistency — 1× in this paper · explained in 3 episodes
• Frustration — 1× in this paper · explained in 2 episodes
• Iterative Refinement — 1× in this paper · explained in 3 episodes
• LLM Integration — 1× in this paper · explained in 2 episodes
• Large Language Model (LLM) — 1× in this paper · explained in 3 episodes
• Pruning — 1× in this paper · explained in 4 episodes
• Redundancy — 1× in this paper · explained in 2 episodes
• Reinforcement Learning (RL) — 1× in this paper · explained in 25 episodes
• World Model — 1× in this paper · explained in 7 episodes

Sources

• Large Language Models for Security Operations Centers: A Comprehensive Survey
• Can SOC Operators Explain their Decisions while Triaging Alarms? A Real-World Study
• AI-Driven Security Alert Screening and Alert Fatigue Mitigation in Security Operations Centers: A Survey
• LLMs in the SOC: An Empirical Study of Human-AI Collaboration in Security Operations Centres
• AutoSkill: Experience-Driven Lifelong Learning via Skill Self-Evolution
• TextGrad: Automatic "Differentiation" via Text

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs