Explainable AI for Cybersecurity Threat Detection – Causal Reasoning from Log Data

Abstract

Cybersecurity threat detection systems are increasingly reliant on Artificial Intelligence (AI) models, but these systems frequently operate as "black boxes," making it difficult for human analysts to understand *why* a particular activity is flagged as a threat. This paper proposes a novel Explainable AI (XAI) system designed to address this challenge by leveraging causal reasoning techniques applied to log data. The system learns and represents causal relationships between log events and identified cybersecurity threats. This allows for the generation of human-understandable explanations for threat detections, providing analysts with valuable insights into the root causes of suspicious activity. The core contribution of this work lies in moving beyond opaque AI models and offering a transparent, interpretable framework for cybersecurity threat analysis. The system's architecture incorporates probabilistic graphical models to represent these causal relationships, enabling inference and explanation generation. Evaluation metrics focus on the accuracy and comprehensibility of the generated explanations, demonstrating the potential of causal reasoning to enhance trust and effectiveness in cybersecurity threat detection.