When Explanations Help or Harm Network Intrusion Alert Triage: A Distribution-Conditional Benchmark

In the high-stakes world of computer security, a constant stream of digital traffic flows through networks every second. Most of this traffic is harmless, but hidden within it are attempts to break in, steal data, or disrupt services. To catch these intruders, organizations use automated systems that act like digital sentinels. These systems constantly scan the flow of data, looking for patterns that look suspicious. When they spot something unusual, they raise an alarm. However, these systems are not perfect; they often raise thousands of false alarms, flagging normal activity as a threat. This creates a massive backlog for human security analysts, who must sift through the noise to find the real danger. The critical question for these teams is not just whether the system can spot an attack, but whether the list of alarms it produces puts the most dangerous threats at the very top, where a tired analyst can see them first.

For years, a popular idea in the field of artificial intelligence has been to use "explanations" to help solve this problem. The logic is simple: if a computer can tell a human why it flagged a specific alarm, the human can trust it more and prioritize it better. Imagine a security guard who not only points at a suspicious person but also explains, "I am watching him because he is holding a large bag and moving quickly." The hope is that adding this reasoning to the alarm list would help analysts find the real attacks faster. But this assumption has never been rigorously tested in the chaotic reality of network security. Does adding an explanation actually help, or does it confuse the system and push the real threats further down the list?

A team of researchers from universities in Turkey set out to answer this question with a careful, controlled experiment. They did not simply ask if explanations were "good" or "bad." Instead, they built a testing ground to see exactly when explanations help, when they do nothing, and when they actually make things worse. They started with three different types of automated detectors, each trained to recognize unusual network activity without being told what specific attacks to look for. These detectors generated a list of alarms based purely on how strange the data looked. The researchers then took this list and applied a specific rule: they added a "signature" to the explanation. This signature was a pre-defined set of features that matched a specific type of attack, such as a Denial of Service attack, which is characterized by a massive flood of data.

The researchers then tested whether boosting the priority of alarms that matched this signature actually improved the order of the list. They used a method called SHAP, which breaks down a computer's decision into the contribution of each piece of data, to see if the computer was focusing on the right things. They compared the original list, ordered only by how strange the data looked, against a new list where alarms matching the attack signature were given a slight boost. They ran this test across thousands of scenarios, using different types of attacks, different detectors, and different sizes of lists to see if the results held up.

The findings were surprising and nuanced. The researchers discovered that adding explanations did not automatically improve the list. In fact, for some of the most common types of attacks, specifically the Denial of Service floods, the explanation actually made the situation worse. When the researchers applied the explanation rule to these attacks, the real threats were pushed deeper into the list, making them harder for an analyst to find. This happened because the automated detectors were already very good at spotting these floods on their own, ranking them at the top. The explanation rule, trying to be helpful, inadvertently shuffled the list and moved the most urgent alarms down.

However, the story was not entirely negative. In a few specific cases, the explanation did help. For certain types of attacks and with specific detectors, the explanation successfully kept the right alarms at the top. But these successes were rare and fragile. The researchers found that the outcome depended entirely on the specific combination of the detector used, the type of attack, and the exact moment in time the data was collected. What worked for one type of attack failed for another. What worked on one day of data did not work on the next.

The study also looked at whether these results would hold up in the real world, where data is messy and unpredictable. They tested their methods on different datasets, including some that were much larger and more complex than the initial test. They found that the pattern remained consistent: the explanation rule was not a universal fix. In some modern datasets, it helped slightly, but in others, it caused harm. Crucially, they tried to build a "selector" that could automatically decide when to use the explanation and when to stick with the simple list. They found that no such selector could be built that was safe enough to use without constant human oversight. The rule that worked in the training data often failed when applied to new, unseen data.

The researchers concluded that the idea of simply adding explanations to security alerts is not a silver bullet. While explanations can be useful for understanding why a computer made a decision, using them to automatically reorder a list of alarms is risky. The study showed that in many cases, the simple list based on the raw "strangeness" score was actually better than the list modified by explanations. The best approach, the researchers suggest, is to treat the explanation as a secondary tool. Security teams should keep the original list as the primary way to prioritize work, using the explanation only as a way to double-check or understand a specific alarm, rather than letting it change the order of the entire list.

This work provides a clear, evidence-based map for the future of security operations. It tells us that we cannot assume that more information always leads to better decisions. Sometimes, the extra layer of explanation can obscure the most important signals. The researchers have shown that before any organization adopts a system that re-ranks alarms based on explanations, they must test it rigorously in their own environment. They must verify that the explanation actually helps their specific detectors find their specific threats. Without this local validation, the attempt to make security smarter with explanations might just make it slower and less effective. The path forward is not to blindly trust the computer's reasoning, but to use it carefully, knowing exactly when it helps and when it harms.