Explainable Cybersecurity Threat Prediction Using Causal Artificial Intelligence and Uncertainty-Aware Intrusion Detection
Main Article Content
Abstract
The increasing sophistication of cyberattacks, evolving network architectures, and growing volumes of network traffic have created a need for intelligent cybersecurity systems that can predict emerging threats while providing transparent and reliable decisions. Conventional intrusion detection systems (IDS) primarily focus on identifying malicious activities using predefined rules or machine learning classifiers, but their effectiveness can be constrained by limited interpretability, distribution shifts, false-positive alerts, and uncertainty in unfamiliar attack scenarios. This paper proposes a conceptual framework for Explainable Cybersecurity Threat Prediction Using Causal Artificial Intelligence and Uncertainty-Aware Intrusion Detection. The framework integrates causal inference, explainable artificial intelligence (XAI), probabilistic threat estimation, and uncertainty-aware decision-making to improve the interpretability and reliability of cyber threat detection. Causal analysis is used to investigate relationships among network characteristics, attack indicators, and potential threat outcomes, helping distinguish meaningful contributing factors from potentially misleading correlations. Explainability techniques, including SHapley Additive exPlanations (SHAP) and Local Interpretable Model-Agnostic Explanations (LIME), can provide human-understandable justifications for individual threat predictions. Meanwhile, uncertainty estimation enables the system to identify low-confidence or unfamiliar observations and escalate them for further investigation rather than relying exclusively on automated classification. The proposed framework can be evaluated using benchmark intrusion detection datasets through detection accuracy, precision, recall, F1-score, false-positive rate, calibration error, uncertainty quality, explanation consistency, and detection latency. By combining causal reasoning with interpretable predictions and uncertainty-aware responses, the framework aims to support more transparent, robust, and trustworthy cybersecurity operations. Its practical effectiveness should be established through empirical evaluation across diverse attack types and changing network environments.
Article Details
Section
This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.
How to Cite
References
[1]. J. Pearl, Causality: Models, Reasoning, and Inference, 2nd ed. Cambridge, U.K.: Cambridge University Press, 2009.
[2]. P. Spirtes, C. Glymour, and R. Scheines, Causation, Prediction, and Search, 2nd ed. Cambridge, MA, USA: MIT Press, 2000.
[3]. J. Peters, D. Janzing, and B. Schölkopf, Elements of Causal Inference: Foundations and Learning Algorithms. Cambridge, MA, USA: MIT Press, 2017.
[4]. M. A. Hernán and J. M. Robins, Causal Inference: What If. Boca Raton, FL, USA: Chapman & Hall/CRC, 2020.
[5]. A. B. Arrieta et al., “Explainable Artificial Intelligence (XAI): Concepts, taxonomies, opportunities and challenges toward responsible AI,” Information Fusion, vol. 58, pp. 82–115, 2020, doi: 10.1016/j.inffus.2019.12.012.
[6]. A. Adadi and M. Berrada, “Peeking inside the black-box: A survey on explainable artificial intelligence (XAI),” IEEE Access, vol. 6, pp. 52138–52160, 2018, doi: 10.1109/ACCESS.2018.2870052.
[7]. R. Guidotti et al., “A survey of methods for explaining black box models,” ACM Computing Surveys, vol. 51, no. 5, Art. no. 93, 2018, doi: 10.1145/3236009.
[8]. M. T. Ribeiro, S. Singh, and C. Guestrin, “‘Why should I trust you?’ Explaining the predictions of any classifier,” in Proc. 22nd ACM SIGKDD Int. Conf. Knowledge Discovery and Data Mining, 2016, pp. 1135–1144, doi: 10.1145/2939672.2939778.
[9]. S. M. Lundberg and S.-I. Lee, “A unified approach to interpreting model predictions,” in Advances in Neural Information Processing Systems, vol. 30, 2017.
[10]. [10] C. Molnar, Interpretable Machine Learning: A Guide for Making Black Box Models Explainable, 2nd ed., 2022. [Online]. Available: https://christophm.github.io/interpretable-ml-book/
[11]. Z. Zhang, H. Al Hamadi, E. Damiani, C. Y. Yeun, and F. Taher, “Explainable artificial intelligence applications in cyber security: State-of-the-art in research,” arXiv preprint arXiv:2208.14937, 2022. [Online]. Available: https://arxiv.org/abs/2208.14937
[12]. A. S. R. Mohammed and H. Al-Hamadi, “Explainable artificial intelligence for cybersecurity: A literature survey,” Annals of Telecommunications, vol. 77, pp. 789–812, 2022, doi: 10.1007/s12243-022-00926-7.
[13]. M. Pawlicki et al., “The survey on the dual nature of xAI challenges in intrusion detection and their potential for AI innovation,” Artificial Intelligence Review, vol. 57, Art. no. 330, 2024, doi: 10.1007/s10462-024-10972-3.
[14]. A. Al, S. Sagiroglu, “Explainable artificial intelligence models in intrusion detection systems,” Engineering Applications of Artificial Intelligence, vol. 144, Art. no. 110145, 2025, doi: 10.1016/j.engappai.2025.110145.
[15]. A. Mohale and T. Obagbuwa, “A systematic review on the integration of explainable artificial intelligence in intrusion detection systems to enhancing transparency and interpretability in cybersecurity,” Frontiers in Artificial Intelligence, vol. 8, Art. no. 1526221, 2025, doi: 10.3389/frai.2025.1526221.
[16]. G. Guo, G. Pleiss, Y. Sun, and K. Q. Weinberger, “On calibration of modern neural networks,” in Proc. 34th Int. Conf. Machine Learning (ICML), 2017, pp. 1321–1330.
[17]. Y. Gal and Z. Ghahramani, “Dropout as a Bayesian approximation: Representing model uncertainty in deep learning,” in Proc. 33rd Int. Conf. Machine Learning (ICML), 2016, pp. 1050–1059.
[18]. C. Koneni and S. Lokula, "Evidence-Quality Telemetry for Cloud Incident Response: Detecting Gaps, Drift, and Integrity Failures in Large-Scale Observability Pipelines," 2026 14th International Symposium on Digital Forensics and Security (ISDFS), Boston, MA, USA, 2026, pp. 1-6, doi: 10.1109/ISDFS69419.2026.11459097.
[19]. V. K. Bharadwaj Parasaram, V. Teja Bathini and S. K. Nalluri, "An Intelligent Digital Framework for Clinical Trial Monitoring Using AI and Cloud-Based Software Platforms," 2026 2nd International Conference on Artificial Intelligence Systems (AIS), San Antonio, TX, USA, 2026, pp. 524-530, doi: 10.1109/AIS69919.2026.11621841.
[20]. Y. Ovadia et al., “Can you trust your model’s uncertainty? Evaluating predictive uncertainty under dataset shift,” in Advances in Neural Information Processing Systems, vol. 32, 2019.
[21]. Koneni, C., S. Lokula, and L. Panjiyar. "A Cloud-Native Approach to Statistical Anomaly Detection and Automated Data Quality Validation." International Journal of Data Science and IoT Management System 4.4 (2025): 533-543
[22]. A. Kendall and Y. Gal, “What uncertainties do we need in Bayesian deep learning for computer vision?” in Advances in Neural Information Processing Systems, vol. 30, 2017.
[23]. C. Guo, G. Pleiss, Y. Sun, and K. Q. Weinberger, “On calibration of modern neural networks,” in Proc. 34th Int. Conf. Machine Learning, 2017, pp. 1321–1330.
[24]. Distributed Data Processing Frameworks for Large-Scale Healthcare Analytics. (2019). International Journal of Advance Industrial Engineering, 7(04), 1–10. doi:10.14741/ijaie/v.7.4.01
[25]. A. N. Angelopoulos and S. Bates, “A gentle introduction to conformal prediction and distribution-free uncertainty quantification,” Foundations and Trends in Machine Learning, vol. 16, nos. 4–5, pp. 494–591, 2023, doi: 10.1561/2200000101.
[26]. M. Ring, S. Wunderlich, D. Scheuring, D. Landes, and A. Hotho, “A survey of network-based intrusion detection data sets,” Computers & Security, vol. 86, pp. 147–167, 2019, doi: 10.1016/j.cose.2019.06.005.
[27]. Vishram Singh, 2026. "Enterprise Resource Planning for Financial Applications: Engineering, Architecture, and Design Principles," International Journal of Scientific Research in Science and Technology, Technoscience Academy, vol. 13(2), pages 653-661, April.
[28]. S. K. Nalluri, V. T. Bathini and V. K. B. Parasaram, "AI-Augmented Manufacturing Execution Systems for Precision Healthcare: A Scalable Framework for Smart Genomic and Proteomic Production," 2026 IEEE 2nd International Conference on Secure IoT, Assured and Trusted Computing (SATC), Houston, TX, USA, 2026, pp. 1-6, doi: 10.1109/SATC69565.2026.11542384.
[29]. N. Moustafa and J. Slay, “UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set),” in Proc. Military Communications and Information Systems Conference (MilCIS), 2015, pp. 1–6, doi: 10.1109/MilCIS.2015.7348942.
[30]. I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, “Toward generating a new intrusion detection dataset and intrusion traffic characterization,” in Proc. 4th Int. Conf. Information Systems Security and Privacy (ICISSP), 2018, pp. 108–116, doi: 10.5220/0006639801080116.
[31]. M. Tavallaee, E. Bagheri, W. Lu, and A. A. Ghorbani, “A detailed analysis of the KDD CUP 99 data set,” in Proc. IEEE Symp. Computational Intelligence for Security and Defense Applications (CISDA), 2009, pp. 1–6, doi: 10.1109/CISDA.2009.5356528.
[32]. A. Vassilev, A. Oprea, A. Fordyce, H. Anderson, X. Davies, and M. Hamin, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations. Gaithersburg, MD, USA: National Institute of Standards and Technology, NIST AI 100-2e2025, 2025. [Online]. Available: https://csrc.nist.gov/pubs/ai/100/2/e2025/final
[33]. Vishram Singh, “Real-Time Financial Data Validation Platform for Enterprise Accounting Systems”, IJCISIM, vol. 18, no. 10s, pp. 467–481, Jul. 2026.
[34]. D. E. Denning, “An intrusion-detection model,” IEEE Transactions on Software Engineering, vol. SE-13, no. 2, pp. 222–232, 1987, doi: 10.1109/TSE.1987.232894.
[35]. A. L. Buczak and E. Guven, “A survey of data mining and machine learning methods for cyber security intrusion detection,” IEEE Communications Surveys & Tutorials, vol. 18, no. 2, pp. 1153–1176, 2016, doi: 10.1109/COMST.2015.2494502.
[36]. Sannidhanam, A. H. (2021). Real-Time Claims Processing Using Event-Driven Architectures. International Journal of Technology, Management and Humanities, 7(01), 36–50. doi:10.21590/07.01.02