💻 computer science

A Dynamic Explainable AI FrameworkforReal-Time Intrusion Detection andAutomatedAlert Prioritization in Security OperationCenters

This paper proposes the Dynamic Explainable Framework (DEF), a three-stage pipeline integrating time-series Transformers, Graph Convolutional Networks, and post-hoc explainability techniques to achieve high-accuracy intrusion detection, significantly reduce analyst alert fatigue by prioritizing critical incidents, and provide transparent, near-real-time rationales for Security Operation Center environments.

Original authors: Muhammad Usama Nazir, Asri Bin Ngadi

Published 2026-06-24

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Muhammad Usama Nazir, Asri Bin Ngadi

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Problem: The "Crying Wolf" in the Security Center

Imagine a Security Operations Center (SOC) as a high-tech control room for a massive city. Inside, a team of human analysts acts as the city's police force, watching screens for signs of trouble (cyberattacks).

Currently, these analysts are drowning. Their automated alarm systems (Intrusion Detection Systems, or IDS) are screaming 50 to 100 times every hour. The problem? Most of these alarms are false alarms—like a smoke detector going off because someone burned toast, not because the building is on fire.

This creates two big issues:

Alert Fatigue: The humans get tired and overwhelmed. They start ignoring the alarms, just like people ignore a crying wolf.
The Black Box: When an alarm does go off, the computer says, "This is bad," but it can't explain why. It's like a judge handing down a verdict without reading the evidence. The analysts don't trust it, so they waste time double-checking everything.

The Solution: The "Dynamic Explainable Framework" (DEF)

The authors propose a new system called DEF. Think of DEF not just as a smarter alarm, but as a super-intelligent, talking detective that helps the human police force.

DEF works in three main stages, like a three-step assembly line:

1. The Time-Traveling Detective (Time-Series Transformer)

Most old systems look at one event at a time (like looking at a single frame of a movie). But hackers often attack in steps, like a thief picking a lock, then opening a door, then stealing a safe.

The Analogy: DEF uses a Time-Series Transformer to watch the whole movie instead of just one frame. It remembers what happened 10 seconds ago to understand what is happening right now. This helps it spot complex, multi-step attacks that other systems miss.

2. The Neighborhood Watch (Graph Convolutional Network)

Old systems look at individual computers in isolation. But hackers often move from one computer to another, like a virus spreading through a neighborhood.

The Analogy: DEF uses a Graph Convolutional Network (GCN) to draw a map of the whole network. It sees how computers are connected. If Computer A talks to Computer B, and Computer B talks to Computer C, DEF sees the whole chain. It can spot a "lateral movement" attack where a hacker hops from machine to machine, which a system looking at single computers would miss.

3. The Explainer and Filter (XAI & Prioritization)

This is the most important part for the humans. Once DEF spots a threat, it doesn't just scream "ALARM!" It does two things:

It Explains: It uses tools called SHAP and LIME to generate a plain-English report.
- Analogy: Instead of just saying "Fire!", it says, "Fire! Because the temperature in the kitchen is 200°F and the smoke sensor is triggered." It gives the "why" instantly.
- Speed: It does this incredibly fast (8.7 milliseconds for a summary, 234 milliseconds for a detailed report), so it doesn't slow down the system.
It Filters: It acts as a bouncer at a club. It calculates a "Priority Score" for every alert.
- If the alert is likely a false alarm (burnt toast), DEF sends it to a "low priority" bin.
- If the alert is a real threat (a real fire), it gets sent to the human analyst immediately.

The Results: What Happened in the Test?

The authors tested this system on a massive dataset (60,000 samples) representing different types of cyberattacks. Here is what they found:

Smarter Detection: The system caught 94.6% of attacks correctly. It was better than standard systems like Random Forest or LSTM.
Fewer False Alarms: It only raised a false alarm 1.16% of the time. Compare this to older signature-based systems (like Snort), which had a 12% false alarm rate. That's a 10x improvement.
The "Bouncer" Effect: This is the biggest win. The system reduced the number of alerts the humans had to look at by 68.9%.
- Before: Analysts saw 50–100 alerts an hour.
- After: Analysts see only 16–31 alerts an hour.
- Crucially: They didn't miss the bad guys. The system still caught 90.7% of the real attacks. It just stopped wasting their time on the "burnt toast."

Why This Matters

The paper argues that by combining smarter detection (seeing the whole movie and the whole neighborhood) with instant explanations and automatic filtering, we can solve the "alert fatigue" problem.

Instead of a human analyst staring at a wall of flashing red lights, confused and tired, they now get a manageable list of high-priority alerts, each with a clear note explaining why it's dangerous. This allows them to react faster and trust the system more.

In short: The paper presents a system that acts like a highly efficient, talking assistant who filters out the noise, explains the signal, and lets the human experts focus only on the real emergencies.

Technical Summary: A Dynamic Explainable AI Framework for Real-Time Intrusion Detection and Automated Alert Prioritization

1. Problem Statement

Security Operation Centers (SOCs) face a critical operational bottleneck: analysts are overwhelmed by 50–100 security alerts per hour, a volume that induces cognitive fatigue and delays incident response. Current Intrusion Detection Systems (IDS) contribute to this issue through high false-positive rates and "black-box" architectures that lack interpretability. Consequently, the global mean time to detect (MTTD) a data breach remains at 181 days, with undetected breaches costing an average of USD 5.46 million.

Existing solutions suffer from three primary gaps:

Static Explanations: Most Explainable AI (XAI) applications generate explanations offline, failing to support real-time inference.
Missing Temporal Modeling: Many approaches treat network flows independently, ignoring the temporal dependencies characteristic of multi-stage attacks.
Absent Alert Prioritization: The literature rarely addresses the joint optimization of explainability and alert volume reduction, leaving the root cause of SOC workload (alert fatigue) unaddressed.

2. Methodology: The Dynamic Explainable Framework (DEF)

The paper proposes the Dynamic Explainable Framework (DEF), a three-stage pipeline designed to integrate detection, explanation, and prioritization into a unified system.

2.1 Framework Architecture

The DEF processes raw network traffic through the following sequential stages:

Detection: A hybrid deep learning model combining temporal and topological analysis.
Explanation: Post-hoc XAI modules (SHAP and LIME) generating rationales at inference time.
Prioritization: A scoring layer that filters low-confidence alerts before they reach the analyst.

2.2 Core Components

Time-Series Transformer Module: Network traffic is treated as a sequential stream. A multi-head self-attention mechanism captures long-range temporal dependencies across a window of $T$ consecutive flows, enabling the detection of multi-stage attack patterns that flow-level classifiers miss.
Graph Convolutional Network (GCN) Module: The network topology is modeled as a graph where nodes represent hosts/services and edges represent communication flows. The GCN learns node embeddings to detect attack propagation patterns (e.g., lateral movement) invisible to per-flow models.
Feature Fusion and Classification: The temporal embedding ( $h_T$ ) from the Transformer and the graph embedding ( $g$ ) from the GCN are concatenated and passed through a classification head to predict the attack class.
XAI Explanation Modules:
- SHAP (SHapley Additive exPlanations): Computes Shapley values to provide global and local feature attributions. The framework utilizes the TreeExplainer algorithm for efficiency.
- LIME (Local Interpretable Model-Agnostic Explanations): Generates local linear approximations for individual instances to explain specific detection decisions.
Alert Prioritization Layer: Each alert $a$ is assigned a composite priority score $P(a)$ :
$P(a) = \alpha \hat{p}_{attack}(a) + \beta S_{SHAP}(a) + \gamma C_{GCN}(a)$
Where $\hat{p}_{attack}$ is the predicted probability of an attack, $S_{SHAP}$ is the mean absolute SHAP value (explanation confidence), and $C_{GCN}$ is the betweenness centrality of the source node. Alerts below a calibrated threshold $\theta$ are suppressed.

3. Experimental Setup

Dataset: A structured benchmark derived from CIC-IDS-2018, comprising 60,000 samples across eight categories (Benign, Bot, Brute Force FTP/SSH, DDoS, DoS Hulk, DoS Slowloris, Web Attack). The dataset reflects real-world class imbalance with ~70% benign traffic.
Preprocessing: Includes cleaning, normalization, SMOTE oversampling for the training set, and a stratified 70/15/15 split.
Baselines: Compared against Snort (signature-based), Random Forest, LSTM, XGBoost, and XGBoost+SHAP.
Metrics: Accuracy, Precision, Recall, Macro F1-score, AUC-ROC, False Positive Rate (FPR), and Alert Reduction Rate (ARR).

4. Key Results

Evaluated on a 9,000-sample test set, the DEF demonstrated the following performance:

4.1 Detection Performance

Accuracy: 94.58%
Macro F1-Score: 90.11%
AUC-ROC: 0.9855
False Positive Rate: 1.16% (a significant improvement over Snort's ~12% FPR).
Comparison: The DEF outperformed Random Forest (F1 87.97%) and LSTM (F1 90.11%) in the comparative analysis, particularly in detecting Bot and Brute Force attacks.

4.2 Alert Prioritization and SOC Impact

Alert Reduction: At a threshold $\theta = 0.6$ , the system reduced the number of alerts presented to analysts by 68.9% (from a baseline of 50–100 alerts/hour to approximately 16–31 alerts/hour).
Recall Preservation: Despite the reduction, the system maintained a 90.72% recall, ensuring that the vast majority of actual attacks were not missed.
Workload Reduction: The reduction translates to a decrease in analyst triage time from ~1,000 minutes/hour to ~310 minutes/hour.

4.3 XAI Efficiency and Quality

SHAP Speed: Generated global and local explanations in 8.7 ms per sample, meeting near-real-time thresholds for SOC dashboards.
LIME Speed: Generated local explanations in 234.8 ms per instance.
Interpretability: The system provides human-interpretable rationales (e.g., specific feature thresholds pushing a prediction toward "attack") alongside each alert, aiding analyst decision-making without requiring ML expertise.

5. Significance and Claims

The paper claims that the DEF addresses the triad of accuracy, workload reduction, and transparency simultaneously, which existing literature often treats in isolation.

Operational Viability: The framework demonstrates that high detection accuracy and significant alert volume reduction are jointly achievable without compromising the recall of actual threats.
Real-Time XAI: By generating explanations in milliseconds (8.7 ms for SHAP), the framework bridges the gap between complex deep learning models and the need for immediate analyst trust and action.
Holistic Approach: Unlike previous studies that focus solely on detection or offline explanation, DEF integrates temporal modeling (Transformer), topological modeling (GCN), and real-time prioritization into a single pipeline suitable for production SOC environments.

The authors note limitations, including the use of a structured subset of CIC-IDS-2018 rather than the full raw dataset, the use of XGBoost as a proxy for LSTM due to environment constraints, and the requirement for real-time network topology snapshots for the GCN module. Future work is proposed to validate the full Transformer+GCN pipeline on the complete dataset and conduct user studies to measure actual analyst response time improvements.