Human-Centric Explainable Federated Threat Intelligence for Trustworthy Cyber-Physical Systems

Abstract

Complex cyber-attacks, privacy sensitive threats and distributed intrusion are becoming more common against Cyber-Physical Systems (CPS), which are the enablers of and underlying smart manufacturing, industrial Internet of Things, healthcare monitoring, and intelligent automation. Older, centralized intrusion detection systems are known to be limited in their scalability, overburdened with communications and to expose a user's privacy, and have limited interpretability, minimizing trust for operation in safety critical systems. In this paper, we propose FedSenti-X, a Human-Centric Explainable Federated Threat Intelligence framework to tackle the challenges and provide trustworthy CPS security analytics. The proposed framework proposes a decentralized federated intrusion detection system along with an adaptive trust-aware aggregation system and a SHAP-based explainable AI for collective and transparent creation of cybersecurity intelligence. Distributed CPS nodes both learn ID models and share model parameters securely without being revealed of the raw operational telemetry. Moreover, the adaptive trust-aware coordination mechanism considers client reliability and thus, alleviates the effects of poisonous and unreliable update arrival during the federated aggregation. To make cyber security reasoning more analyst-friendly and easier to see, feature-level threat attribution is produced by the explainability part of the system. Extensive experiments with various benchmark cybersecurity datasets, such as UNSW-NB15 and CICIoT2023, validate its effectiveness in enhancing intrusion detection accuracy, F1-score performance, minimizing communication overhead, and providing interpretability, over traditional centralized and non-explainable federated intrusion detection approaches. The proposed framework offers an approach towards scalable, privacy-aware and human-centric generation of cybersecurity intelligence for next generation of distributed CPS ecosystems.