407556

A Novel Explainable AI Framework for Real-Time Cybersecurity Threat Detection and Mitigation

Article

Last updated: 15 Feb 2025

Subjects

-

Tags

علوم الحاسب.

Abstract

Cybersecurity remains a critical challenge as cyberattacks grow increasingly sophisticated and diverse. This paper presents a novel Explainable AI (XAI) framework for real-time detection and mitigation of cyber threats, including Distributed Denial of Service (DDoS) attacks, Shellcode exploitation, Reconnaissance, and Worm propagation. The framework employs advanced feature engineering and class-specific techniques to enhance detection accuracy, particularly for overlapping categories like DoS and Exploits. It integrates visual explainability tools, automates incident response processes, and seamlessly connects with Security Information and Event Management (SIEM) systems to support operational decision-making. Using eXtreme Gradient Boost (XGBoost) combined with SHapley Additive exPlanations (SHAP) for explainability, the system achieves both high detection accuracy and transparency. Additionally, a comparative analysis with Random Forest (RF) and Support Vector Machine (SVM) highlights the proposed framework's superior performance. Experimental results demonstrate an accuracy of 89% and an F1-score of 0.88, with strong detection capabilities for high-priority threats like Generic and Shellcode while maintaining high precision across all classes. This research underscores the potential of the framework to transform real-time cybersecurity by ensuring precise, transparent, and actionable threat detection

DOI

10.21608/ijtec.2025.354111.1008

Keywords

explainable AI, Cybersecurity, SHAP, XGBoost, SIEM Integration

Authors

First Name

Ghada

Last Name

Abdelhady

MiddleName

-

Affiliation

General Systems Engineering Faculty of Engineering October University for Modern Sciences and Arts

Email

ghada.abdelhady@hotmail.com

City

-

Orcid

0000-0001-9375-0617

Volume

4

Article Issue

10

Related Issue

53083

Issue Date

2025-01-01

Receive Date

2025-01-21

Publish Date

2025-01-01

Page Start

77

Page End

106

Print ISSN

2974-413X

Online ISSN

2974-4148

Link

https://ijtec.journals.ekb.eg/article_407556.html

Detail API

http://journals.ekb.eg?_action=service&article_code=407556

Order

3

Type

الدراسات والبحوث العلمية.

Type Code

2,636

Publication Type

Journal

Publication Title

المجلة الدولية للتكنولوجيا والحوسبة التعليمية

Publication Link

https://ijtec.journals.ekb.eg/

MainTitle

A Novel Explainable AI Framework for Real-Time Cybersecurity Threat Detection and Mitigation

Details

Type

Article

Created At

01 Feb 2025