On the Importance of Domain-specific Explanations in AI-based Cybersecurity Systems (Technical Report)

Explainability is critical in cybersecurity because users need to understand why AI systems flag threats. The paper emphasizes that in high-stakes domains like cybersecurity, AI systems that cannot explain their decisions create a major vulnerability—security teams cannot properly evaluate whether an alert is trustworthy or take appropriate action without understanding the reasoning behind it.

Generic explainability approaches are insufficient for cybersecurity. The paper proposes domain-specific desiderata (requirements) for cybersecurity explanations, indicating that off-the-shelf explainability methods from other fields don't adequately address the unique challenges cybersecurity professionals face when interpreting AI decisions about potential threats.

The field lacks a unified framework for building explainable cybersecurity AI systems. The authors provide a general architecture and roadmap to guide future development, suggesting that currently there is no standardized approach for combining different research areas to create AI systems that are both effective at detecting threats and transparent about how they reach their conclusions.

Responsible AI in cybersecurity requires balancing multiple competing needs. The paper's comparative analysis examines explainability approaches across multiple dimensions, highlighting that developers must navigate tradeoffs between factors like accuracy, interpretability, and practical usability for security professionals.