Network IDS Alert Classification Using Hybrid Transfer-Active Learning: Reducing Analyst Burden in SOC Environments

Network Intrusion Detection Systems (NIDS) are essential for cybersecurity monitoring but generate overwhelming volumes of alerts, with most having low importance. This paper introduces Hybrid-NIDS-AL, a novel framework that combines transfer learning with a hierarchical ensemble of active learning strategies for efficient NIDS alert classification. Unlike previous approaches that require extensive labeled datasets or rely solely on uncertainty sampling, our methodology incorporates adaptive stratified sampling across different alert partitions and leverages knowledge transfer from generic security alerts to environment-specific contexts. Experiments on a comprehensive dataset of 1.2 million alerts from a university SOC demonstrate that Hybrid-NIDS-AL achieves an F1-score of 0.973, outperforming traditional supervised approaches and state-of-the-art active learning methods. Our framework reaches 90% of peak performance with only 300 labeled samples-40% fewer than comparable methods. Additionally, Hybrid-NIDS-AL demonstrates superior resilience to concept drift, maintaining consistent performance over time. These results suggest significant potential for reducing human analyst workload while improving alert classification accuracy in operational security environments.