mlsanityData to 14 Oct 2026

DeepXplain: XAI-Guided Autonomous Defense Against Multi-Stage APT Campaigns

arXiv 2603.21296 ↗First posted 22 Mar 2026cs.CR cs.AIcited by 1

On the map: Deep reinforcement learning methods → Adversarial robustness and RL in finance

Abstract (arXiv)

Advanced Persistent Threats (APTs) are stealthy, multi-stage attacks that require adaptive and timely defense. While deep reinforcement learning (DRL) enables autonomous cyber defense, its decisions are often opaque and difficult to trust in operational environments. This paper presents DeepXplain, an explainable DRL framework for stage-aware APT defense. Building on our prior DeepStage model, DeepXplain integrates provenance-based graph learning, temporal stage estimation, and a unified XAI pipeline that provides structural, temporal, and policy-level explanations. Unlike post-hoc methods, explanation signals are incorporated directly into policy optimization through evidence alignment and confidence-aware reward shaping. To the best of our knowledge, DeepXplain is the first framework to integrate explanation signals into reinforcement learning for APT defense. Experiments in a realistic enterprise testbed show improvements in stage-weighted F1-score (0.887 to 0.915) and success rate (84.7% to 89.6%), along with higher explanation confidence (0.86), improved fidelity (0.79), and more compact explanations (0.31). These results demonstrate enhanced effectiveness and trustworthiness of autonomous cyber defense.

Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Placed in Adversarial robustness and RL in finance, one of 15 directions in Deep reinforcement learning methods. Builds on 4 of its 11 references that are in the map. First posted on arXiv 22 Mar 2026.

Builds on

4 of 11 references.

Closest ancestors · 2

Same direction, newest first

  1. 2026DeepStage: Learning Autonomous Defense Policies Against Multi-Stage APT Campaigns17 Mar
  2. 2024Entity-based Reinforcement Learning for Autonomous Cyber Defence23 Oct

Other references · 2

  1. 2019GNNExplainer: Generating Explanations for Graph Neural Networkscited by 737
  2. 2022A Comprehensive Survey on Trustworthy Graph Neural Networks: Privacy, Robustness, Fairness, and Explainabilitycited by 118

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026DeepFaith: Evidence-Grounded LLMs for Faithful Incident Reporting in Multi-Stage APT Defensecited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Attackers Strike Back? Not Anymore -- An Ensemble of RL Defenders Awakens for APT Detection
  2. 2025Unveiling the Black Box: A Multi-Layer Framework for Explaining Reinforcement Learning-Based Cyber Agents
  3. 2025Automated Cyber Defense with Generalizable Graph-based Reinforcement Learning Agents
  4. 2026Distilling Knowledge from Large Language Models into Lightweight Reinforcement Learning Agents for Autonomous Cyber Operations
  5. 2025Interpreting Agent Behaviors in Reinforcement-Learning-Based Cyber-Battle Simulation Platforms
  6. 2026SoK: The Pitfalls of Deep Reinforcement Learning for Cybersecurity
  7. 2026Ask the Expert: LLM-Guided Reinforcement Learning for Autonomous Cyber Defense
  8. 2026Trident : How to Break Deep Reinforcement Learning Cyber Defenses (Agentic)