Information-Dense Reasoning for Efficient and Auditable Security Alert Triage

TL;DR

AIDR introduces a gradient-based compression method for reasoning chains in security alert triage, balancing accuracy, transparency, and efficiency by optimizing information density within token and latency constraints.

Contribution

The paper presents a hybrid cloud-edge framework with gradient-based compression of reasoning chains, enabling efficient, auditable, and privacy-compliant security alert triage.

Findings

Achieves 68% token reduction in alert summaries.

40.6% latency reduction compared to Chain-of-Thought.

Maintains robustness to data corruption and out-of-distribution data.

Abstract

Security Operations Centers face massive, heterogeneous alert streams under minute-level service windows, creating the Alert Triage Latency Paradox: verbose reasoning chains ensure accuracy and compliance but incur prohibitive latency and token costs, while minimal chains sacrifice transparency and auditability. Existing solutions fail: signature systems are brittle, anomaly methods lack actionability, and fully cloud-hosted LLMs raise latency, cost, and privacy concerns. We propose AIDR, a hybrid cloud-edge framework that addresses this trade-off through constrained information-density optimization. The core innovation is gradient-based compression of reasoning chains to retain only decision-critical steps--minimal evidence sufficient to justify predictions while respecting token and latency budgets. We demonstrate that this approach preserves decision-relevant information while minimizing complexity. We construct compact datasets by distilling alerts into 3-5 high-information bullets (68% token reduction), train domain-specialized experts via LoRA, and deploy a cloud-edge architecture: a cloud LLM routes alerts to on-premises experts generating SOAR-ready JSON. Experiments demonstrate AIDR achieves higher accuracy and 40.6% latency reduction versus Chain-of-Thought, with robustness to data corruption and out-of-distribution generalization, enabling auditable and efficient SOC triage with full data residency compliance.