A security team has deployed a machine learning model for detecting command-and-control (C2) traffic. Over three months, the false positive rate has doubled while the model version hasn't changed. What is the most likely explanation?

• A.The model has been corrupted by a data poisoning attack from the network traffic it processes
• B.Concept drift: the traffic patterns in the production environment have shifted (new applications, cloud migrations, CDN changes) causing legitimate traffic to increasingly resemble the C2 patterns the model was trained to detect
• C.The SIEM integration has a bug causing duplicate alert generation
• D.The model is overfitting to recent traffic data since it is continuously learning