An Explainable AI Based Alert Triage Framework for Security Operations Centres: Architecture, Evaluation, And Analyst Centred Design

Security operations centers (SOCs) today are overwhelmed by a continually growing volume of security alerts from a variety of detection technologies. Analysts typically receive thousands of alerts per shift. Many of these alerts are false positives or low-priority events that cause serious analyst fatigue, delayed incident response, and increased organizational risk. The false-positive rate is typically greater than 50% in business environments. This paper proposes and evaluates ExTriage, a novel Explainable Artificial Intelligence (XAI)-based alert triage framework integrating: (i) a high-performance ensemble classifier combining XGBoost and a multi-layer perceptron; (ii) a SHAP-based global and local explanation engine; (iii) a counterfactual explanation module; and (iv) a RankNet-inspired alert prioritization module. Evaluated on CICIDS-2017, CICIDS-2018, and UNSW-NB15, ExTriage achieves a macro F1-score of 97.89% and AUC-ROC of 0.9963 while reducing false-positive rates by 70.8%. In a controlled study with 24 professional SOC analysts, average triage time was reduced from 47 to 8.2 seconds per alert, with statistically significant improvements in trust calibration, decision confidence, and alert disposition accuracy.