# Domain Knowledge Aided Explainable Artificial Intelligence for Intrusion Detection and Response

arXiv: https://arxiv.org/abs/1911.09853 · HTML: https://mlsanity.com/paper/1911.09853/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 22 Nov 2019.

## Built on by (most cited first, 10 of 10)

- [Explainable Artificial Intelligence Approaches: A Survey](https://mlsanity.com/paper/2101.09429/) (2021)
- [Explainable Intrusion Detection Systems (X-IDS): A Survey of Current Methods, Challenges, and Opportunities](https://mlsanity.com/paper/2207.06236/) (2022)
- [Creating an Explainable Intrusion Detection System Using Self Organizing Maps](https://mlsanity.com/paper/2207.07465/) (2022)
- [Explainable AI over the Internet of Things (IoT): Overview, State-of-the-Art and Future Directions](https://mlsanity.com/paper/2211.01036/) (2022)
- [Explainable Intrusion Detection Systems Using Competitive Learning Techniques](https://mlsanity.com/paper/2303.17387/) (2023)
- [Explainable Artificial Intelligence and Cybersecurity: A Systematic Literature Review](https://mlsanity.com/paper/2303.01259/) (2023)
- [A Comparative Analysis of DNN-based White-Box Explainable AI Methods in Network Security](https://mlsanity.com/paper/2501.07801/) (2025)
- [Impact of Feature Encoding on Malware Classification Explainability](https://mlsanity.com/paper/2307.05614/) (2023)
- [XAI-based Feature Selection for Improved Network Intrusion Detection Systems](https://mlsanity.com/paper/2410.10050/) (2024)
- [Accuracy and Efficiency Trade-Offs in LLM-Based Malware Detection and Explanation: A Comparative Study of Parameter Tuning vs. Full Fine-Tuning](https://mlsanity.com/paper/2511.19654/) (2025)

## Abstract (arXiv)

Artificial Intelligence (AI) has become an integral part of modern-day security solutions for its ability to learn very complex functions and handling "Big Data". However, the lack of explainability and interpretability of successful AI models is a key stumbling block when trust in a model's prediction is critical. This leads to human intervention, which in turn results in a delayed response or decision. While there have been major advancements in the speed and performance of AI-based intrusion detection systems, the response is still at human speed when it comes to explaining and interpreting a specific prediction or decision. In this work, we infuse popular domain knowledge (i.e., CIA principles) in our model for better explainability and validate the approach on a network intrusion detection test case. Our experimental results suggest that the infusion of domain knowledge provides better explainability as well as a faster decision or response. In addition, the infused domain knowledge generalizes the model to work well with unknown attacks, as well as opens the path to adapt to a large stream of network traffic from numerous IoT devices.