Design and Development of an Explainable Artificial Intelligence Framework for Real-Time Cyber Threat Detection and Response in Enterprise Information Systems

Abstract

This study designs and develops an Explainable Artificial Intelligence framework for real-time cyber-threat detection and response in enterprise information systems. CICIDS2017 cyber-threat dataset was used to develop and evaluate the framework. Duplicate records, missing data values, identifiers, and variables with zero variance were removed from the dataset. The remaining features were reduced using correlation and mutual-information techniques and partitioned into training, testing, and validation sets in a stratified manner. Class weights were estimated based on inverse-variance frequencies. Extreme Gradient Boosting was used as the multiclass threat detection classifier while TreeSHAP was used to explain model predictions. A risk-based response decision engine was designed to merge prediction confidence with threat levels and deploy countervailing measures such as monitoring, alerting, rate-limiting, blocking, isolating, and escalating based on the risk scores of the events. Experiments revealed that the designed model achieved an accuracy of 97.84%, a macro precision of 91.26%, a macro recall of 88.43%, a macro F1-Score of 89.12%, a weighted F1-Score of 97.82%, and a false-positive rate of 1.89%. Moreover, the model achieved a macro-average ROC-AUC of 0.9721. SHAP values revealed that the Flow Duration, Total Forward Packets, and Flow Packets/s features had the most significant influence on the model’s predictions. The end-to-end processing time of the framework was 7.07ms on average, which demonstrates its ability to perform real-time threat detection and response. This study concludes that detecting cyber-threats with explainable artificial intelligence and automatically responding to them using a risk-based decision engine provides a reliable cybersecurity framework for enterprise information systems.