# ChatIDS: Advancing Explainable Cybersecurity Using Generative AI

arXiv: https://arxiv.org/abs/2306.14504 · HTML: https://mlsanity.com/paper/2306.14504/

## Key facts

- Cited by 12 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 26 Jun 2023.

## Built on by (most cited first, 12 of 12)

- [Actionable Cyber Threat Intelligence using Knowledge Graphs and Large Language Models](https://mlsanity.com/paper/2407.02528/) (2024)
- [Cyber Sentinel: Exploring Conversational Agents in Streamlining Security Tasks with GPT-4](https://mlsanity.com/paper/2309.16422/) (2023)
- [A Survey of Large Language Models in Cybersecurity](https://mlsanity.com/paper/2402.16968/) (2024)
- [MoRSE: Bridging the Gap in Cybersecurity Expertise with Retrieval Augmented Generation](https://mlsanity.com/paper/2407.15748/) (2024)
- [Large Language Models for Network Intrusion Detection Systems: Foundations, Implementations, and Future Directions](https://mlsanity.com/paper/2507.04752/) (2025)
- [FAA Framework: A Large Language Model-Based Approach for Credit Card Fraud Investigations](https://mlsanity.com/paper/2506.11635/) (2025)
- [Interpretable Anomaly-Based DDoS Detection in AI-RAN with XAI and LLMs](https://mlsanity.com/paper/2507.21193/) (2025)
- [Boardwalk Empire: How Generative AI is Revolutionizing Economic Paradigms](https://mlsanity.com/paper/2410.15212/) (2024)
- [LLM-based Multi-class Attack Analysis and Mitigation Framework in IoT/IIoT Networks](https://mlsanity.com/paper/2510.26941/) (2025)
- [RAG-targeted Adversarial Attack on LLM-based Threat Detection and Mitigation Framework](https://mlsanity.com/paper/2511.06212/) (2025)
- [Generative AI and Federated Learning for Intrusion Detection Systems: A Survey](https://mlsanity.com/paper/2607.01305/) (2026)
- [(EC)2: Event-Centric Explainability for Cybersecurity Through Multi-Agent LLM Investigations](https://mlsanity.com/paper/2607.26201/) (2026)

## Abstract (arXiv)

Intrusion Detection Systems (IDS) are a proven approach to secure networks. Network-based IDS are typically installed on routers or Internet gateways. This allows them to inspect any incoming or outgoing network traffic, to compare the signatures of network packets with a database of suspicious signatures, or to use artificial intelligence. If the IDS identifies a network connection as suspicious, it sends an alert to the respective user. However, in a privately used network, it is difficult for users without cybersecurity expertise to understand IDS alerts, to distinguish cyberattacks from false alarms, and to respond in time with adequate measures. This puts the security of home networks, smart home installations, home-office workers, etc. at risk, even if an IDS is correctly installed and configured. In this work, we propose ChatIDS, our approach to explain IDS alerts to non-experts by using large language models. We evaluate the feasibility of ChatIDS by using ChatGPT, and we identify open research issues with the help of interdisciplinary experts in artificial intelligence. Our results show that ChatIDS has the potential to increase network security by proposing meaningful security measures in an intuitive language from IDS alerts. Nevertheless, some potential issues in areas such as trust, privacy, ethics, etc. need to be resolved, before ChatIDS might be put into practice.