An Explainable AI-Driven Cyber Threat Intelligence Framework for Proactive and Adaptive Cyberattack Detection

Abstract

The rapid proliferation of sophisticated cyberattacks poses an unprecedented challenge to existing intrusion detection and threat intelligence systems. Conventional machine learning (ML)-based detection approaches, while effective in controlled environments, suffer from opacity, limited adaptability, and an inability to proactively anticipate novel attack vectors. This paper presents XAI-CTI, a novel Explainable Artificial Intelligence (XAI)-driven Cyber Threat Intelligence (CTI) framework designed to enable proactive and adaptive cyberattack detection. The proposed framework integrates a multi-layered threat intelligence pipeline comprising real-time data ingestion, federated feature engineering, ensemble-based anomaly detection, and post-hoc explainability modules grounded in SHAP (SHapley Additive exPlanations) and LIME (Local Interpretable Model-agnostic Explanations). By coupling gradient-boosted ensemble models with attention-based deep neural architectures, XAI-CTI achieves state-of-the-art detection accuracy of 99.21% on the CIC-IDS2017 dataset, 98.87% on the UNSW-NB15 benchmark, and 97.94% on the NSL-KDD corpus, with average false positive rates below 0.31%. The adaptive learning module employs continual learning strategies to mitigate concept drift and maintain performance under evolving threat landscapes. Extensive evaluations demonstrate that the explainability layer reduces analyst investigation time by 43% compared to black-box baselines while maintaining detection fidelity.