CyTReX: Explainable AI-Based Cybersecurity Threat Reasoning Framework for DER Networks

arXiv:2610.04286v1 Announce Type: cross Abstract: Distributed Energy Resource (DER) environments rely on network communication protocols to coordinate control commands, measurements, and device states across edge assets and cloud systems. Edge anomaly detection systems (ADS) monitor this traffic to identify deviations from normal communication behavior, flagging suspicious flows for further investigation. When the ADS flags abnormal network traffic, a single attack label is often insufficient for operational response: the label reports the detector's selected class but does not expose alternative threat interpretations that may warrant investigation. This paper presents Cybersecurity Threat Reasoning with Explainable Artificial Intelligence (CyTReX), an evidence-grounded threat reasoning framework for DER security that transforms network-level anomaly alerts into ranked, analyst-facing threat hypotheses designed to support Security Operations Center (SOC) triage and investigation. CyTReX constrains large language model (LLM) reasoning through a structured evidence packet, defined as a consolidated record of detection outputs, model explanations, and cyber threat intelligence (CTI) context. The evidence packet integrates edge-layer anomaly detection evidence, cloud reasoning layer attack interpretation, Shapley Additive Explanations (SHAP) network-feature attributions, surrogate decision rules, and Model Context Protocol (MCP)-enabled CTI enrichment. This ensures that every ranked hypothesis and attack-tree branch is traceable to explicit evidence rather than free-form LLM inference, and that incomplete or conflicting evidence is communicated rather than suppressed. Evaluation across five configurations shows that additional reasoning components improve hypothesis specificity, evidence traceability, and analytical grounding, with the complete pipeline providing the richest evidence-grounded reasoning context.

Related

• LCGuard: Latent Communication Guard for Safe KV Sharing in Multi-Agent Systems
• Prospective Interpretation Risk: Principled Communication Control Between LLMs
• Byzantine Cheap Talk: Adversarial Resilience and Topology Effects in LLM Coordination Games
• Out of Sight, Not Out of Mind: Unveiling Latent Attack in Latent-based Multi-Agent Systems
• Agentic Federated Learning: Rule-Based Client and Server Agents for Adaptive Training

Source: arXiv cs.LG | 2026-10-06