IsoEx: an explainable unsupervised approach to process event logs cyber investigation

Explainability is critical for cybersecurity adoption: The paper argues that current machine learning approaches for investigating cyber attacks lack adequate explainability, and emphasizes that SOC and CERT teams need to understand why a system flags something as suspicious to actually use these tools in practice.

IsoEx uses structural features to improve detection accuracy: The method leverages the hierarchical structure of command lines (parent/child relationships) and log formatting patterns rather than just content alone, achieving greater accuracy than traditional anomaly detection approaches for identifying malicious commands.

Unsupervised learning reduces manual labeling burden: By using unsupervised anomaly detection rather than requiring labeled examples of attacks, IsoEx can help cybersecurity teams investigate threats without needing extensive pre-existing datasets of known cyber attacks—a practical advantage given the constantly evolving nature of threats.

Lightweight design supports overwhelmed security teams: The method is designed to be computationally efficient, helping Security Operation Centers and emergency response teams process investigations faster and focus their human expertise on higher-value analysis rather than routine log review.

Interpretable AI features enable human oversight: The paper emphasizes that the detection features themselves and XAI visualization techniques allow security analysts to verify and understand the system's decisions, supporting responsible deployment where humans maintain meaningful control over cybersecurity decisions.