Page 214 - Kaleidoscope Academic Conference Proceedings 2024

2024 ITU Kaleidoscope Academic Conference

Figure 2 – Sample of security incident response generated using Mistral-7B language model on security events

security events generated by different security systems. This Intelligence (XAI), which envisioned security measures for
research seeks to automate the generation of interpretable cyber threat hunting. Recognizing the rising complexity of
security responses via integrating Mistral-7B into existing cyber threats and the need for transparent decision-making in
systems that makes it easier to understand and respond security operations, the authors investigated the incorporation
to potential threats promptly. It automatically correlate of XAI approaches into current security frameworks.
events, gather context, identify root causes and generate By improving the explainability of security mechanisms
clear security response messages explaining threats and such as threat detection algorithms and decision support
recommended actions. This AI-driven automation with systems, the study aims to provide security analysts with
transparent analysis allows analysts to quickly focus on actionable insights into discovered threats and suspicious
critical issues first through prioritized and contextual alerting behavior. The authors highlighted the potential of XAI
that continuously improves with feedback. The scope of this in boosting cybersecurity methods by combining machine
research includes exploration of effectiveness of Mistral-7B in learning interpretability approaches, visualization tools, and
generating interpretable security responses using real-world domain-specific knowledge representation. This will allow
datasets from security solutions. Figure 2 shows the sample for more effective threat-hunting and response tactics. The
of security incident response generated using Mistral-7B study also stressed the importance of user-centered design
model. The details of implementation is shared in section ideas are when creating XAI-powered security systems. This
3 and 4. ensures that human operators can understand and utilize the
generated insights. Khan et al. [4] enriched the literature
on corporate security by investigating the use of User and
2. LITERATURE SURVEY
Entity Behavior Analytics (UEBA) for anomaly identification
and threat mitigation. The study focuses on using UEBA
Neupane et al. [2] performed an in-depth review of techniques to examine the behavior of individuals and entities
Explainable Intrusion Detection Systems (X-IDS) with the within corporate networks, with the goal of identifying
goal of understanding the existing environment, difficulties, deviations from regular patterns that might indicate possible
and prospects in the sector. The study highlighted the security breaches. The authors proved the usefulness of
importance of openness and interpretability in intrusion UEBA in proactively detecting and responding to new
detection, highlighting the necessity for security systems cyber threats using sophisticated analytics and machine
to develop warnings that are not only accurate but also learning techniques. The study also showed importance for
understandable to human analysts. The authors gained corporate security to have context-aware anomaly detection
valuable insights into current practices and identified and adaptive response mechanisms. Through empirical
crucial research paths to propel the field forward by assessments and case studies, the authors gave practical
examining various methods to enhance the understandability insights into the implementation and integration of UEBA
of intrusion detection systems, such as interpretable machine systems in real-world security operations, delivering useful
learning models and rule-based systems. The survey also lessons for enterprises looking to improve their cybersecurity
identified practical and implementation problems with using posture through behavioral analytics. Alahmadi et al. [5]
explainable intrusion detection systems in the real world. This performed qualitative research to investigate the viewpoints
shows how important it is to bridge the gap between complex of Security Operations Center (SOC) analysts on security
detection algorithms and useful information for security alarms, with a special emphasis on the frequency of false
professionals. Kumar et al. [3] suggested a unique approach positives. Their findings, presented at the 31st USENIX
to cybersecurity with their study on Explainable Artificial

– 170 –