Zhibo Zhang, Hussam Al Hamadi, Ernesto Damiani, Chan Yeob Yeun, Fatma Taher
AI is widely used for cybersecurity but lacks transparency: Machine Learning and Deep Learning models are deployed to detect intrusions, malware, and spam more efficiently than traditional methods, but they operate as "black boxes" where security experts cannot explain how the systems reach their conclusions.
Lack of explainability undermines trust in AI-based defenses: The paper emphasizes that the absence of transparency and interpretability in current AI cybersecurity techniques decreases human confidence in these systems, which is particularly problematic as cyber attacks become "increasingly diverse and complicated."
Explainable AI (XAI) is essential for next-generation cybersecurity: The survey argues that applying XAI methods is critical to creating cybersecurity models that maintain high accuracy while allowing security professionals and customers to understand, trust, and effectively manage AI-based defense mechanisms.
The field requires balancing performance with interpretability: A key challenge identified is the need to develop explainable cybersecurity models without sacrificing the advanced detection capabilities that make AI-based approaches superior to signature-based and rule-based strategies.
This survey presents a comprehensive review of current literature on Explainable Artificial Intelligence (XAI) methods for cyber security applications. Due to the rapid development of Internet-connected systems and Artificial Intelligence in recent years, Artificial Intelligence including Machine Learning (ML) and Deep Learning (DL) has been widely utilized in the fields of cyber security including intrusion detection, malware detection, and spam filtering. However, although Artificial Intelligence-based approaches for the detection and defense of cyber attacks and threats are more advanced and efficient compared to the conventional signature-based and rule-based cyber security strategies, most ML-based techniques and DL-based techniques are deployed in the black-box manner, meaning that security experts and customers are unable to explain how such procedures reach particular conclusions. The deficiencies of transparency and interpretability of existing Artificial Intelligence techniques would decrease human users' confidence in the models utilized for the defense against cyber attacks, especially in current situations where cyber attacks become increasingly diverse and complicated. Therefore, it is essential to apply XAI in the establishment of cyber security models to create more explainable models while maintaining high accuracy and allowing human users to comprehend, trust, and manage the next generation of cyber defense mechanisms. Although there are papers reviewing Artificial Intelligence applications in cyber security areas and the vast literature on applying XAI in many fields including healthcare, financial services, and criminal justice, the surprising fact is that there are currently no survey research articles that concentrate on XAI applications in cyber security.
Accepted by IEEE Access
Citation data from Semantic Scholar