# Detection, Explanation and Filtering of Cyber Attacks Combining Symbolic and Sub-Symbolic Methods

arXiv: https://arxiv.org/abs/2212.13991 · HTML: https://mlsanity.com/paper/2212.13991/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 14 of its 32 references that are in the map.
- First posted on arXiv 23 Dec 2022.

## Builds on (most cited first, 14 of 14)

- [Inductive Representation Learning on Large Graphs](https://mlsanity.com/paper/1706.02216/) (2017)
- [Link Prediction Based on Graph Neural Networks](https://mlsanity.com/paper/1802.09691/) (2018)
- [GNNExplainer: Generating Explanations for Graph Neural Networks](https://mlsanity.com/paper/1903.03894/) (2019)
- [Neurosymbolic AI: The 3rd Wave](https://mlsanity.com/paper/2012.05876/) (2020)
- [Explainable Security](https://mlsanity.com/paper/1807.04178/) (2018)
- [Knowledge-based Transfer Learning Explanation](https://mlsanity.com/paper/1807.08372/) (2018)
- [Explaining Network Intrusion Detection System Using Explainable AI Framework](https://mlsanity.com/paper/2103.07110/) (2021)
- [On the Importance of Domain-specific Explanations in AI-based Cybersecurity Systems (Technical Report)](https://mlsanity.com/paper/2108.02006/) (2021)
- [A Holistic Natural Language Generation Framework for the Semantic Web](https://mlsanity.com/paper/1911.01248/) (2019)
- [Machine learning on knowledge graphs for context-aware security monitoring](https://mlsanity.com/paper/2105.08741/) (2021)
- [Zero-shot learning approach to adaptive Cybersecurity using Explainable AI](https://mlsanity.com/paper/2106.14647/) (2021)
- [An energy-based model for neuro-symbolic reasoning on knowledge graphs](https://mlsanity.com/paper/2110.01639/) (2021)
- [A Hybrid Approach for an Interpretable and Explainable Intrusion Detection System](https://mlsanity.com/paper/2111.10280/) (2021)
- [Combining Sub-Symbolic and Symbolic Methods for Explainability](https://mlsanity.com/paper/2112.01844/) (2021)

## Built on by (most cited first, 3 of 3)

- [On the use of neurosymbolic AI for defending against cyber attacks](https://mlsanity.com/paper/2408.04996/) (2024)
- [A Synergistic Approach In Network Intrusion Detection By Neurosymbolic AI](https://mlsanity.com/paper/2406.00938/) (2024)
- [Enhancing Anomaly-Based Intrusion Detection Systems with Process Mining](https://mlsanity.com/paper/2604.18066/) (2026)

## Abstract (arXiv)

Machine learning (ML) on graph-structured data has recently received deepened interest in the context of intrusion detection in the cybersecurity domain. Due to the increasing amounts of data generated by monitoring tools as well as more and more sophisticated attacks, these ML methods are gaining traction. Knowledge graphs and their corresponding learning techniques such as Graph Neural Networks (GNNs) with their ability to seamlessly integrate data from multiple domains using human-understandable vocabularies, are finding application in the cybersecurity domain. However, similar to other connectionist models, GNNs are lacking transparency in their decision making. This is especially important as there tend to be a high number of false positive alerts in the cybersecurity domain, such that triage needs to be done by domain experts, requiring a lot of man power. Therefore, we are addressing Explainable AI (XAI) for GNNs to enhance trust management by exploring combining symbolic and sub-symbolic methods in the area of cybersecurity that incorporate domain knowledge. We experimented with this approach by generating explanations in an industrial demonstrator system. The proposed method is shown to produce intuitive explanations for alerts for a diverse range of scenarios. Not only do the explanations provide deeper insights into the alerts, but they also lead to a reduction of false positive alerts by 66% and by 93% when including the fidelity metric.