Detection, Explanation and Filtering of Cyber Attacks Combining Symbolic and Sub-Symbolic Methods

Explainability reduces alert fatigue: By combining symbolic (rule-based) and sub-symbolic (machine learning) methods to explain why a cybersecurity system flagged an alert, the researchers achieved a 66% reduction in false positive alerts, and 93% when including additional quality checks—directly addressing a major pain point for security teams who waste resources investigating incorrect alarms.

Graph-based AI can integrate multiple data sources: The paper demonstrates that Graph Neural Networks can seamlessly combine security data from different monitoring tools using human-understandable vocabularies, enabling more comprehensive threat detection than systems that analyze data sources in isolation.

Black-box AI decisions are problematic in cybersecurity: The researchers highlight that while machine learning models are increasingly used for intrusion detection, their lack of transparency is particularly problematic in cybersecurity where domain experts must manually verify alerts—making explainability not just a nice-to-have but essential for practical deployment.

Combining AI approaches improves trustworthiness: Rather than relying solely on neural networks or symbolic rules, the hybrid approach produces "intuitive explanations" that security professionals can understand and act upon, building the trust necessary for organizations to confidently adopt AI-driven security tools.