Explainable artificial intelligence envisioned security mechanism for cyber threat hunting

Abstract

Cyber threat hunting proactively searches for cyber threats, which are undetected by the traditional defense mechanisms. It scans deep to identify malicious programs (ie, malware) that escape from detection. It is important because sophisticated cyber threats can bypass the cyber security mechanisms. The performance of the cyber threat hunting can be improved through artificial intelligence (AI), especially, explainable AI (XAI), which adds trust component to the cyber threat hunting process. Due to the inclusion of XAI, the security experts get the full explanations of the detected threats as the working of the detection model in XAI is known. Information, like, which one is a threat, how it has been detected, and why it has been detected, can be obtained very easily due to the inclusion of XAI in the cyber threat hunting. Therefore, an XAI‐envisioned mechanism for cyber threat hunting has been proposed (in short, XAISM‐CTH). The network and threat models of XAISM‐CTH are designed and discussed. The conducted security analysis proves the security of XAISM‐CTH against various potential attacks. XAISM‐CTH also performs better than the other existing schemes. At the end, a practical implementation of XAISM‐CTH has been provided to observe its impact on the performance of the system.

Effective Cyber Threat Hunting: Where and how does it fit?

“…When it comes to finding postulations that integrate CTH with a broader cyber security approach, this is far easier said than done. In this regard, Kumar & Chacko (2020) states that while there are models, frameworks and systematic processes developed for CTH, much of the discussions published on these artefacts entail definitions and practical approaches to CTH activities per se. Kumar & Chacko (2020) further observes that there is a lack of propositions that integrate CTH as part of a broader approach.…”

“…In this regard, Kumar & Chacko (2020) states that while there are models, frameworks and systematic processes developed for CTH, much of the discussions published on these artefacts entail definitions and practical approaches to CTH activities per se. Kumar & Chacko (2020) further observes that there is a lack of propositions that integrate CTH as part of a broader approach. This observation confirms our literature review which likewise found a lack of such propositions.…”