PaperlayerView exact revision on arXiv

Source-linked AI summary

CyTReX: Explainable AI-Based Cybersecurity Threat Reasoning Framework for DER Networks

Damilola Popoola, Souradeep Bhattacharya, Manimaran Govindarasu

arXiv:2610.04286v1cs.CRcs.AIcs.LG

TL;DR

A single anomaly label does not reveal alternative threat interpretations or the evidence needed to distinguish them, limiting the context available for SOC triage. CyTReX constrains LLM reasoning with an evidence packet to generate ranked, traceable hypotheses; its evaluation shows a trade-off between label anchoring and richer interpretation.

  • Problem

    A single-class alert does not expose plausible alternative threat interpretations or the evidence analysts need for triage, escalation, or response.

    Source: §I · p. 1

  • Method

    CyTReX constrains LLM reasoning with a structured packet combining anomaly evidence, attack interpretation, SHAP features, surrogate rules, and CTI to generate ranked, evidence-traceable hypotheses.

    Source: §I · p. 1

  • Results

    C5 trades some exact label anchoring for richer evidence-grounded interpretation, mitigation context, and visibility into possible co-occurring behaviors.

    Source: B. Attack-Label Reasoning Results and… · p. 7

  • Takeaways & Limitations

    CyTReX provides SOC analysts evidence context for triage, including traceable hypotheses and communication of incomplete or conflicting evidence.

    Source: §VII · p. 8

Abstract

from arXiv · show

Distributed Energy Resource (DER) environments rely on network communication protocols to coordinate control commands, measurements, and device states across edge assets and cloud systems. Edge anomaly detection systems (ADS) monitor this traffic to identify deviations from normal communication behavior, flagging suspicious flows for further investigation. When the ADS flags abnormal network traffic, a single attack label is often insufficient for operational response: the label reports the detector's selected class but does not expose alternative threat interpretations that may warrant investigation. This paper presents Cybersecurity Threat Reasoning with Explainable Artificial Intelligence (CyTReX), an evidence-grounded threat reasoning framework for DER security that transforms network-level anomaly alerts into ranked, analyst-facing threat hypotheses designed to support Security Operations Center (SOC) triage and investigation. CyTReX constrains large language model (LLM) reasoning through a structured evidence packet, defined as a consolidated record of detection outputs, model explanations, and cyber threat intelligence (CTI) context. The evidence packet integrates edge-layer anomaly detection evidence, cloud reasoning layer attack interpretation, Shapley Additive Explanations (SHAP) network-feature attributions, surrogate decision rules, and Model Context Protocol (MCP)-enabled CTI enrichment. This ensures that every ranked hypothesis and attack-tree branch is traceable to explicit evidence rather than free-form LLM inference, and that incomplete or conflicting evidence is communicated rather than suppressed. Evaluation across five configurations shows that additional reasoning components improve hypothesis specificity, evidence traceability, and analytical grounding, with the complete pipeline providing the richest evidence-grounded reasoning context.

I. INTRODUCTION

DER network anomalies can reflect different attacks, but a single-class label does not show alternative interpretations or the evidence needed to distinguish them. CyTReX addresses this gap with ranked, evidence-supported hypotheses for SOC triage.

I. INTRODUCTION

  • A single-class detection label omits plausible alternative threat interpretations and the evidence needed to distinguish them.DNP3 anomalies may reflect replay, unauthorized control commands, or denial-of-service behavior.Source: §I · p. 1
  • AI and ML detectors improve coverage, but without feature and adversary context, SOC analysts lack a reliable basis for triage, escalation, or response.Analysts need to understand which network features drove an alert and how they relate to known adversary techniques.Source: §I · p. 1
  • CyTReX converts ML-generated network anomaly alerts into ranked hypotheses using a structured packet of detection evidence, SHAP attributions, surrogate rules, and CTI.The packet constrains LLM reasoning and keeps hypotheses and attack-tree branches traceable to evidence, including when evidence is incomplete or conflicting.Source: §I · p. 1

A. DER-Integrated Grid Architecture

  • DER-integrated architectures connect assets and control systems through multiple communication paths, while network anomalies can require different interpretations by protocol, device, and operational context.Edge devices forward alerts to cloud analytics, but neither layer alone supplies the full context needed for reasoning.Source: A. DER-Integrated Grid Architecture · pp. 1–2

B. DER Cybersecurity Context and Threat Reasoning

DER security alerts require interpretation beyond a detector label because operational meaning depends on device, command, and supporting evidence. Prior approaches offer detection, feature explanations, CTI, or LLM analysis, but the section identifies a need to connect these into evidence-grounded threat hypotheses.

B. DER Cybersecurity Context and Threat Reasoning

  • The same abnormal traffic may have different operational consequences depending on the affected device, command type, and available supporting evidence.A single detection label does not indicate alternative interpretations or how device and command context should influence triage.Source: B. DER Cybersecurity Context and… · p. 2

C. Need for Evidence-Grounded Reasoning

  • Without supporting evidence, analysts cannot distinguish confirmed threats from benign or uncertain behavior or assess which secondary hypotheses merit investigation.Evidence-grounded reasoning links observed network behavior, model explanations, CTI context, and evidence gaps to make hypotheses traceable.Source: C. Need for Evidence-Grounded Reasoning · p. 2

III. RELATED WORK

  • Anomaly detection and closed-set classification provide limited attack semantics, and closed-set accuracy does not establish reliability on attacks excluded from training.Feature explanations alone also do not establish whether evidence supports a plausible threat hypothesis or how it combines with operational context and threat intelligence.Source: §III · p. 2
  • The related-work discussion identifies a gap in methods that connect low-level cyber-physical evidence to ranked, evidence-grounded threat hypotheses.It contrasts isolated detection, feature-level explanations without operational context, and LLMs without strict evidence grounding.Source: §III · p. 3

IV. PROPOSED METHODOLOGY

CyTReX uses an edge-cloud workflow to transform DER communication or telemetry alerts into ranked threat hypotheses and structured attack trees. The cloud layer enriches alert evidence before an LLM organizes it for uncertainty-aware investigation.

A. Framework Overview

  • CyTReX transforms communication or telemetry alerts into structured attack trees with ranked threat hypotheses through an edge-cloud pipeline.The pipeline supports analyst investigation while retaining uncertainty rather than treating detection outputs as final decisions.Source: A. Framework Overview · p. 3, Figure 2 · p. 3
  • The edge layer identifies abnormal traffic and forwards alert evidence to the cloud reasoning layer.The edge layer provides early abnormality evidence; the framework overview does not assign it final attack attribution.Source: A. Framework Overview · p. 3
  • The cloud layer adds attack-class interpretation, model explanations, CTI context, and evidence-quality signals before the LLM structures ranked hypotheses and attack-tree branches.The output presents supported interpretations, secondary possibilities, mitigation context, and evidence gaps for analyst decisions.Source: A. Framework Overview · p. 3

B. Edge Evidence Generation Layer

The edge layer detects deviations near grid assets and forwards anomaly evidence, not final attack attribution. The cloud layer interprets alerts as ranked hypotheses in light of evidence quality and uncertainty.

B. Edge Evidence Generation Layer

  • The edge layer observes communication or telemetry near a grid asset and identifies deviations from expected operation, without making final attack attributions.Its output summarizes the anomaly, deviation strength, communication context, and alert-contributing features for the cloud layer.Source: B. Edge Evidence Generation Layer · p. 3

C. Cloud Threat Reasoning Layer

  • The cloud layer examines whether an alert fits known or plausible attack behavior, enriches it with model explanations and CTI, and organizes results for attack-tree generation.It combines edge evidence with interpretation, explanation features, and threat intelligence to support ranked hypotheses.Source: C. Cloud Threat Reasoning Layer · p. 3
  • Because one alert may indicate multiple attack behaviors, cloud reasoning ranks hypotheses according to available evidence, its quality, and remaining uncertainty.Classification is not treated as a final decision.Source: C. Cloud Threat Reasoning Layer · p. 4

D. Model Explanation Layer

CyTReX combines model explanations and behavior-oriented CTI in a structured evidence packet for LLM-generated attack trees. The outputs rank threat hypotheses while retaining supporting evidence, uncertainty, and evidence gaps.

D. Model Explanation Layer

  • SHAP feature attributions and surrogate decision rules expose the cloud classifier’s behavior, helping ground hypotheses in interpretable features and preserve uncertainty when evidence is weak or incomplete.A consistency check between SHAP and rule evidence supplies an evidence-quality signal.Source: D. Model Explanation Layer · p. 4

E. Cyber Threat Intelligence Context Layer

  • The CTI layer links observed behavior to candidate MITRE ATT&CK for ICS techniques, tactics, and mitigations, with CAPEC providing related attack-pattern context.MCP-enabled retrieval contributes provenance-aware CTI evidence and guards against unsupported CTI claims when alerts provide only behavior-level evidence.Source: E. Cyber Threat Intelligence Context… · p. 4

F. Unified Evidence Packet and Attack-Tree Reasoning

  • The unified evidence packet supplies the LLM with edge and cloud evidence, explanations, CTI, quality signals, and provenance metadata for attack-tree generation.Trees include the suspicious event, ranked hypotheses, supporting evidence, uncertainty notes, and evidence gaps; they support analyst interpretation rather than automated response execution.Source: F. Unified Evidence Packet and… · p. 4

V. EXPERIMENTAL EVALUATION

The evaluation emulates DNP3 communication from virtual DER devices through edge detection to cloud reasoning. It uses a DNP3 case study with held-out OOD labels to examine reasoning beyond the classifier’s trained attack-label space.

A. Experimental Setup

  • Three virtual DER devices simulate real-time DNP3 traffic for edge detection, followed by cloud processing and local LLM attack-tree generation across all five configurations.The same llama3.1:8b model and settings are used across configurations so output differences reflect the active evidence components.Source: A. Experimental Setup · p. 4, Figure 3 · p. 4

B. Dataset and Case-Study Labels

  • The DNP3 case study trains the cloud classifier on six attack labels and normal traffic, holding DNP3_ENUM and DNP3_INFO out as reconnaissance-style OOD cases.A representative edge alert batch is reused across configurations; CyTReX operates on normalized evidence objects rather than protocol-specific assumptions.Source: B. Dataset and Case-Study Labels · p. 4
  • A 70:30 split is used before closed-set edge and cloud model evaluation, while held-out OOD cases test reasoning outside the trained attack-label space.The edge detector learns normal communication behavior and is tested on normal and attack traffic; the cloud classifier uses the closed-set labels.Source: B. Dataset and Case-Study Labels · pp. 4–5

C. Model Explanation and Feature Attribution

CyTReX checks agreement between surrogate rules and SHAP evidence, then combines that consistency with surrogate rule quality to verify model confidence. The weighting favors feature-level agreement and surrogate fidelity, while future work will assess alternative schemes.

C. Model Explanation and Feature Attribution

  • CyTReX sets the SHAP evidence budget from the number of unique features in surrogate rules, retaining at least one top-ranked feature for comparison.The Rule-SHAP consistency formulation is adapted from prior work, while the surrogate rule-quality score is introduced as an additional verification signal.Source: C. Model Explanation and Feature… · p. 5
  • Rule-SHAP consistency combines feature overlap, direction agreement, and rule coverage, weighted 0.45, 0.10, and 0.45, respectively.The larger overlap and coverage weights emphasize feature-level agreement; direction agreement receives less weight because SHAP and surrogate branch directions may differ for behaviorally relevant features.Source: C. Model Explanation and Feature… · p. 5
  • The surrogate rule-quality score combines fidelity and rule density, with fidelity weighted 0.65 and rule density weighted 0.35.Both verification scores range from 0 to 1; rule-only features not overlapping with SHAP are retained as possible additional surrogate decision patterns.Source: C. Model Explanation and Feature… · p. 5
  • Verified confidence adjusts original model confidence using the combined verification signal; future work will assess how alternative weighting schemes affect ranking, evidence-quality labels, and reasoning consistency.The signal is the maximum of Rule-SHAP consistency and half the surrogate rule-quality score.Source: C. Model Explanation and Feature… · p. 5

D. MCP-Enabled CTI Retrieval

MCP retrieval enriches alerts with behavior-level CTI and provenance, while the evaluation compares five configurations in edge-only and full-pipeline tracks. Ranked outputs identify the first three hypotheses as H1, H2, and H3.

D. MCP-Enabled CTI Retrieval

  • MCP retrieval enriches the evidence packet with behavior-level CTI and provenance, but does not perform detection, classification, model explanation, attack-tree generation, or mitigation.Alert-derived behavioral terms guide retrieval from MITRE ATT&CK for ICS and CAPEC, whose techniques, patterns, mitigations, references, and provenance are packaged for LLM reasoning.Source: D. MCP-Enabled CTI Retrieval · p. 5

E. Evaluation Configurations

  • Five configurations form two evaluation tracks: C1–C2 test edge-only reasoning and CTI’s effect there, while C3–C5 test cloud interpretation, model explanations, CTI, and the complete workflow.Table IV summarizes the configurations.Source: E. Evaluation Configurations · p. 5
  • H1 denotes the highest-ranked hypothesis, with H2 and H3 denoting the second- and third-ranked hypotheses.Source: E. Evaluation Configurations · p. 5

F. Evaluation Criteria

The evaluation assesses both model performance and threat-reasoning behavior across configurations. It reports the selected edge and cloud models alongside criteria for hypothesis quality, evidence grounding, and uncertainty handling.

F. Evaluation Criteria

  • The edge layer uses accuracy, precision, recall, F1-score, confusion matrix, and prediction latency to assess detection performance.Threat-reasoning behavior is assessed separately from ML detection performance.Source: F. Evaluation Criteria · p. 5
  • Threat reasoning is assessed through H1 hypotheses, runtime latency, evidence grounding, and uncertainty handling across five configurations.For held-out DNP3_ENUM and DNP3_INFO cases, the evaluation examines whether unseen reconnaissance-like behavior is treated as uncertain rather than forced into a closed-set conclusion.Source: F. Evaluation Criteria · p. 6

A. ML Performance and Model Selection

  • The Isolation Forest and nearest-neighbor ensemble was selected for edge abnormality detection, while LightGBM was selected for cloud attack-behavior interpretation.Table VI reports accuracy, precision, recall, and F1-score for model selection.Source: A. ML Performance and Model Selection · p. 6

B. Attack-Label Reasoning Results and Latency

Across trained DNP3 attack labels, C3 provides the strongest label anchoring, while C5 combines explanation and CTI evidence for broader semantic interpretations. Runtime reflects the end-to-end reasoning process, and hypothesis mismatches indicate limits to precise attribution.

B. Attack-Label Reasoning Results and Latency

  • A mismatch marks a weakly related H1 interpretation, such as C1 mapping COLD_RESTART to DNP3 replay, and indicates insufficient evidence for precise attack attribution.The evaluation distinguishes exact label matches, semantic matches, and mismatches.Source: B. Attack-Label Reasoning Results and… · p. 6
  • Edge-only configurations produce broader hypotheses without supervised attack-class context, while CTI can widen interpretations from protocol-specific labels to behavior-level concepts.C5 provides richer semantic interpretation for STOP_APP and restart-related cases, but may shift from protocol-specific labels toward broader threat interpretations.Source: B. Attack-Label Reasoning Results and… · pp. 6–7
  • C3 preserves COLD_RESTART, DISABLE_UNSOLICITED, REPLAY, and WARM_RESTART as H1, while C5 trades some label anchoring for richer evidence-grounded interpretation and mitigation context.REPLAY appears as H1 under all five configurations; INIT_DATA is not preserved as H1, and C5 can map restart cases to denial of service or STOP_APP to command injection.Source: B. Attack-Label Reasoning Results and… · pp. 6–7, Table V · p. 7
  • Runtime across C1–C5 is not strictly monotonic because it combines LLM generation, CTI retrieval, evidence-packet size, and attack-tree complexity.C3 has the lowest average latency; C2 has the highest, mainly because broader WARM_RESTART CTI matches increased packet size and generation time; C5 remains relatively stable.Source: B. Attack-Label Reasoning Results and… · p. 7

C. Replay Attack-Tree Analysis

Across five configurations, the evaluation finds richer evidence-grounded reasoning when cloud reasoning, model explanations, and CTI complement edge-only detection. The replay and OOD cases show how the framework ranks hypotheses while retaining uncertainty and exposing the need for open-set handling.

C. Replay Attack-Tree Analysis

  • MITRE ATT&CK for ICS context and mitigation entries guide investigation and frame replay-related behaviors, but do not prove that every retrieved technique or pattern occurred.Mitigation overlap across H1, H2, and H3 includes communication authenticity, authentication, network allowlisting, and out-of-band validation; STOP_APP maps to command injection, while restart-related cases map to denial-of-service-oriented behavior.Source: C. Replay Attack-Tree Analysis · p. 7
  • For REPLAY, the C5 tree ranks DNP3_REPLAY_ATTACK first and DNP3_MANIPULATION_ATTACK second, while UNKNOWN preserves uncertainty when packet-sequence evidence cannot confirm replay.The figure depicts the root event, ranked hypotheses, supporting evidence, ICS techniques, CAPEC patterns, and mitigation context.Source: C. Replay Attack-Tree Analysis · p. 7, Figure 4 · p. 8

D. Out-of-Distribution Behavior

  • Held-out DNP3_ENUM and DNP3_INFO tests yield security-relevant hypotheses for unseen reconnaissance-style behavior, though C5 can pull unseen cases toward known classes such as replay.C2 uses edge evidence and CTI for broad hypotheses; C5 adds cloud interpretation, SHAP attribution, and surrogate-rule evidence, highlighting the need for explicit open-set handling.Source: D. Out-of-Distribution Behavior · p. 8

VII. CONCLUSION

  • Across five configurations, cloud reasoning, model explanation, and CTI enrichment improve evidence traceability and analytical grounding, while edge-only reasoning remains limited for attack attribution.The conclusion describes the complete pipeline as combining detection evidence, XAI-based explanations, CTI enrichment, and LLM-based attack-tree reasoning.Source: §VII · p. 8
  • Future work will evaluate CyTReX on larger datasets and broader DER communication scenarios, and extend it toward human-in-the-loop response support for analyst-approved mitigation actions.Source: §VII · p. 8
Loading 2610.04286v1…