Self-Verifying Anomaly Detection using Explainable AI for Cybersecurity of DER Networks

Explainability builds trust in AI security systems: The paper demonstrates that security operators need to understand why an AI system flags a potential cyber attack, not just that it does. By combining machine learning with explainable AI (SHAP), the ExCYDER framework helps security teams interpret alerts and respond more confidently to threats in power grid networks.

Self-verification catches AI reasoning errors: The framework includes a "self-checking" mechanism that validates whether the AI's decision-making is internally consistent—essentially asking "does the AI's explanation match its actual reasoning?" This achieved 44.6% rule-SHAP consistency and helps distinguish between reliable and unreliable alerts without sacrificing detection accuracy (over 98%).

Explainable AI doesn't require sacrificing speed or accuracy: A common concern is that making AI systems more transparent slows them down. This research shows the verification process adds only 14.5 milliseconds per alert with minimal computational overhead, proving that transparency and performance can coexist in real-time security operations.

Critical infrastructure needs interpretable defenses: As power grids become more distributed and vulnerable to sophisticated cyber attacks, security operators cannot rely on "black box" AI systems they cannot understand. This work addresses a real operational need—enabling Security Operation Centers to trust and act on AI-generated security alerts in energy networks.