AUTHOR=Moyle Steve , Martin Andrew , Allott Nicholas 

TITLE=XAI Human-Machine collaboration applied to network security

JOURNAL=Frontiers in Computer Science

VOLUME=Volume 6 - 2024

YEAR=2024

URL=https://www.frontiersin.org/journals/computer-science/articles/10.3389/fcomp.2024.1321238

DOI=10.3389/fcomp.2024.1321238

ISSN=2624-9898

ABSTRACT=Cyber attacking is easier than cyber defending -attackers only need to find one breach, while the defenders must successfully repel all attacks. This research demonstrates how cyber defenders can increase their capabilities by joining forces with eXplainable-AI (XAI) utilising interactive human-machine collaboration. With a global shortfall of cyber defenders there is a need to amplify their skills using AI. Cyber asymmetries make propositional machine learning techniques impractical. Human reasoning and skill is a key ingredient in defence and must be embedded in the AI framework. For Human-Machine collaboration to work requires that the AI is an ultra-strong machine learner and can explain its models. Unlike Deep Learning, Inductive LogicProgramming can communicate what it learns to a human. An empirical study was undertaken using six months of eavesdropped network traffic from an organisation generating up-to 562K network events daily. Easier-to-defend devices were identified using a form of the Good-Turing Frequency estimator which is a promising form of volatility measure. A behavioural cloning grammar in explicit symbolic form was then produced from a single device's network activity using the compression algorithm SEQUITUR. A novel visualisation was generated to allow defenders to identify network sequences they wish to explain. Interactive Inductive Logic Programming (the XAI) is supplied the network traffic meta data, sophisticated pre-existing cyber security background knowledge, and one recurring sequence of events from a single device to explain. A co-inductive process between the human cyber defender and the XAI where the human is able to understand, then refute and shape the XAI's developing model, to produce a model that conforms with the data as well as the original device designers programming. The acceptable model is in a form that can be deployed as an ongoing active cyber defence.