Explainable AI for cyber threat Intelligence: Enhancing analyst trust

The increasing sophistication and frequency of cyberattacks necessitate advanced and transparent decision-making frameworks for threat intelligence and risk assessment. While artificial intelligence (AI) has demonstrated significant potential in automating threat detection, predicting attack patterns, and prioritizing incident response, the opaque nature of many AI models particularly deep learning poses challenges in trust, interpretability, and regulatory compliance. This paper presents an Explainable AI (XAI)-driven framework for enhancing Cyber Threat Intelligence (CTI) and risk assessment, enabling security analysts to understand, validate, and act upon AI-generated insights with confidence. The proposed approach integrates state-of-the-art machine learning algorithms with model-agnostic and model-specific interpretability techniques, such as SHapley Additive exPlanations (SHAP), Local Interpretable Model-agnostic Explanations (LIME), Layer-wise Relevance Propagation (LRP), and attention-based visualization. The framework processes diverse CTI data sources including network traffic logs, vulnerability feeds, malware signatures, and open-source intelligence (OSINT) to identify malicious patterns, quantify risks, and generate actionable intelligence. By coupling predictive accuracy with transparency, the system not only improves detection and classification of advanced persistent threats (APTs), phishing campaigns, and zero-day exploits, but also facilitates compliance with emerging AI governance frameworks, such as the EU AI Act and NIST AI Risk Management Framework. Experimental evaluations on benchmark cybersecurity datasets demonstrate that the XAI-enabled models maintain high precision and recall while offering interpretable outputs that significantly reduce analyst decision latency and improve collaborative threat response. The paper further discusses the role of XAI in mitigating bias, enhancing accountability, and fostering human–machine teaming in security operations centers (SOCs). Practical implementation considerations including scalability, computational efficiency, and integration with existing Security Information and Event Management (SIEM) platforms are addressed, along with recommendations for future research in multi-modal XAI for cybersecurity. This research underscores the critical value of explainability in AI-driven CTI, ensuring that automated systems are not only effective but also transparent, trustworthy, and aligned with organizational and regulatory requirements for responsible AI deployment in cyber defense.

XAI is critical for establishing trust and enabling the appropriate development of machine learning models. By offering transparency into how these models make judgements, XAI enables researchers and users to uncover potential biases, admit limits, and eventually enhance the fairness and dependability of AI systems. In this paper, we demonstrates two techniques, LIME and SHAP, used to improve the interpretability of machine learning models. Assessing Explainable AI (XAI) approaches is critical in searching for transparent and interpretable artificial intelligence (AI) models. Explainable AI (XAI) approaches are designed to provide insight into how complex models make decisions. This paper thoroughly analyzes two prominent XAI methods: Shapley Additive explanations (SHAP) and Local Interpretable Model-agnostic Explanations (LIME). This study aims to understand the decision made by a machine learning model and how the model came to that decision. We discuss the approaches and framework of both LIME and SHAP and assess their behavior in predicting the model's outcome.

The rise of sophisticated cyber threats, such as malware and network intrusions, necessitates the use of Artificial Intelligence (AI) for efficient and accurate detection. However, traditional AI models often operate as black boxes, leaving security analysts without insights into the reasoning behind critical decisions. Explainable AI (XAI) addresses this challenge by providing interpretability and transparency in AI-driven cybersecurity solutions. This paper explores the role of XAI in malware analysis and network intrusion detection, highlighting how interpretable models enhance trust, improve decision-making, and facilitate regulatory compliance. It examines state-of-the-art XAI techniques, including Shapley Additive Explanations (SHAP), Local Interpretable Model-agnostic Explanations (LIME), and rule-based systems, for their application in identifying malicious software and detecting network anomalies. Furthermore, the paper discusses challenges, such as computational overhead and scalability, while presenting future directions for integrating XAI in real-time and hybrid security frameworks. By advancing the adoption of interpretable AI, cybersecurity systems can achieve greater effectiveness and reliability, addressing both technical and organizational needs in combating evolving cyber threats.

This paper presents a comprehensive survey of the applications, challenges, and limitations of Generative AI (GenAI) in enhancing threat intelligence within cybersecurity, supported by real-world case studies. We examine a wide range of data sources in Cyber Threat Intelligence (CTI), including security reports, blogs, social media, network traffic, malware samples, dark web data, and threat intelligence platforms (TIPs). This survey provides a full reference for integrating GenAI into CTI. We discuss various GenAI models such as Large Language Models (LLMs) and Deep Generative Models (DGMs) like Variational Autoencoders (VAEs), Generative Adversarial Networks (GANs), and Diffusion Models, explaining their roles in detecting and addressing complex cyber threats. The survey highlights key applications in areas such as malware detection, network traffic analysis, phishing detection, threat actor attribution, and social engineering defense. We also explore critical challenges in deploying GenAI, including data privacy, security concerns, and the need for interpretable and transparent models. As regulations like the European Commission’s AI Act emerge, ensuring trustworthy AI solutions is becoming more crucial. Real-world case studies, such as the impact of the WannaCry ransomware, the rise of deepfakes, and AI-driven social engineering, demonstrate both the potential and current limitations of GenAI in CTI. Our goal is to provide foundational insights and strategic direction for advancing GenAI’s role in future cybersecurity frameworks, emphasizing the importance of innovation, adaptability, and ongoing learning to enhance resilience against evolving cyber threats. Ultimately, this survey offers critical insights into how GenAI can shape the future of cybersecurity by addressing key challenges and providing actionable guidance for effective implementation.

Electrocardiogram signal analysis can be time-consuming, tedious, and error-prone. Therefore, automated analysis is need of time that will assist clinicians in detecting cardiac abnormalities accurately and efficiently. Recently, deep learning models have shown unprecedented progress and strong arrhythmia classification capabilities, but their deployment in the medical sector is constrained due to their “black-box” nature. This paper proposes a robust explainability method to assist in explaining the underlying decision-making process in deep neural networks (DNN) and help provide feedback on biases that would benefit in improving DNN models. To achieve these objectives, initially, a deep learning model is trained on the MIT-BIH Arrhythmia Database and their classification performance is evaluated. The classification findings are then interpreted using the post-hoc explanation methods such as the SHapley Additive exPlanations (SHAP), Local Interpretable Model-Agnostic Explanations (LIME) and Gradient-weighted Class Activation Mapping (Grad-CAM) that interpret the decision rationale. As these methods are initially proposed for image applications therefore a new masking approach is proposed to cater these post-hoc explainability methods for ECG time-series data. After evaluating these methods for ECG arrhythmia classification, several drawbacks are drawn such as they fail to locate a feature’s importance if there are multiple occurrences of the same feature in a signal and also, SHAP and LIME perform random perturbations that sometimes produce unreliable explanations. Therefore, to overcome the drawbacks associated with these post-hoc explainability methods on time-series data, a novel K-GradCam method is proposed. The proposed K-GradCam method ensemble the benefits of these gradient based and perturbation based approaches and has demonstrated advantages over SHAP, Grad-CAM and LIME in terms of interpreting the models’ decisions. To compare the the proposed technique with post-hoc explainability methods quantitatively, the confidence index of the proposed method is evaluated using dice loss. The proposed method shares 71% similarity with SHAP and 81% similarity with Grad-CAM methods; however, it shares the benefits of both methods and is computationally faster than SHAP and LIME.

Significant advancements have been achieved recently in the use of artificial intelligence (AI) to solve healthcare-related problems. A potential method for identifying and treating many illnesses is machine learning (ML). The “Breast Cancer Dataset” was used in this work to perform classification tasks using ML techniques including Support Vector Machine (SVM), Random Forest (RF) and MultiLayer Perceptron (MLP) for identifying the forms of breast cancer, either Benign or Malignant. The SVM, RF, and MLP achieved impressive PR scores exceeding 0.98. However, MLP exhibited superior performance among these algorithms, achieving an exceptional AUC value of 99.71. Conversely, SVM slightly outperformed the other algorithms in terms of training accuracy, with a value of 97.90%. This work used shapley additive explanations (SHAP) and local interpretable model-agnostic explanations (LIME) to shed light on how these categorization algorithms made judgments. These interpretability methodologies showed that the majority of characteristics consistently predicted the presence of malignant or benign cancer types. This study demonstrates how ML algorithms' decision-making procedures may be understood, possibly promoting the use of ML in clinical settings for medical diagnosis.

Explainable artificial intelligence for predicting dengue outbreaks in Bangladesh using eco-climatic triggers.

BackgroundTuberculosis spondylitis (TS), commonly known as Pott’s disease, is a severe type of skeletal tuberculosis that typically requires surgical treatment. However, this treatment option has led to an increase in healthcare costs due to prolonged hospital stays (PLOS). Therefore, identifying risk factors associated with extended PLOS is necessary. In this research, we intended to develop an interpretable machine learning model that could predict extended PLOS, which can provide valuable insights for treatments and a web-based application was implemented.MethodsWe obtained patient data from the spine surgery department at our hospital. Extended postoperative length of stay (PLOS) refers to a hospitalization duration equal to or exceeding the 75th percentile following spine surgery. To identify relevant variables, we employed several approaches, such as the least absolute shrinkage and selection operator (LASSO), recursive feature elimination (RFE) based on support vector machine classification (SVC), correlation analysis, and permutation importance value. Several models using implemented and some of them are ensembled using soft voting techniques. Models were constructed using grid search with nested cross-validation. The performance of each algorithm was assessed through various metrics, including the AUC value (area under the curve of receiver operating characteristics) and the Brier Score. Model interpretation involved utilizing methods such as Shapley additive explanations (SHAP), the Gini Impurity Index, permutation importance, and local interpretable model-agnostic explanations (LIME). Furthermore, to facilitate the practical application of the model, a web-based interface was developed and deployed.ResultsThe study included a cohort of 580 patients and 11 features include (CRP, transfusions, infusion volume, blood loss, X-ray bone bridge, X-ray osteophyte, CT-vertebral destruction, CT-paravertebral abscess, MRI-paravertebral abscess, MRI-epidural abscess, postoperative drainage) were selected. Most of the classifiers showed better performance, where the XGBoost model has a higher AUC value (0.86) and lower Brier Score (0.126). The XGBoost model was chosen as the optimal model. The results obtained from the calibration and decision curve analysis (DCA) plots demonstrate that XGBoost has achieved promising performance. After conducting tenfold cross-validation, the XGBoost model demonstrated a mean AUC of 0.85 ± 0.09. SHAP and LIME were used to display the variables’ contributions to the predicted value. The stacked bar plots indicated that infusion volume was the primary contributor, as determined by Gini, permutation importance (PFI), and the LIME algorithm.ConclusionsOur methods not only effectively predicted extended PLOS but also identified risk factors that can be utilized for future treatments. The XGBoost model developed in this study is easily accessible through the deployed web application and can aid in clinical research.

Age is a significant risk factor for mild cognitive impairment (MCI) and Alzheimer’s disease (AD) and identifying brain age patterns is critical for comprehending the normal aging and MCI/AD processes. Prior studies have widely established the univariate relationships between brain regions and age, while multivariate associations remain largely unexplored. Herein, various artificial intelligence (AI) models were used to perform brain age prediction using an MRI dataset (n = 825). The optimal AI model was then integrated with the feature importance methods, namely Shapley additive explanations (SHAP), local interpretable model-agnostic explanations, and layer-wise relevance propagation, to identify the significant multivariate brain regions hierarchically involved in this prediction. Our results showed that the deep learning model (referred to as AgeNet) outperformed conventional machine learning models for brain age prediction, and that AgeNet integrated with SHAP (referred to as AgeNet-SHAP) identified all ground-truth perturbed regions as key predictors of brain age in semi-simulation, demonstrating the validity of our methodology. In the experimental dataset, when compared to cognitively normal (CN) participants, MCI exhibited moderate differences in brain regions, whereas AD showed highly robust and widely distributed regional differences. Individualized AgeNet-SHAP regional features further showed associations with clinical severity scores in the AD continuum. These results collectively facilitate data-driven explainable AI approaches for disease progression, diagnostics, prognostics, and personalized medicine efforts.

Heart disease remains a major global health challenge, underscoring the need for predictive models that are both accurate and interpretable to support early diagnosis and clinical decision-making. Using Shapley Additive Explanations (SHAP) and Local Interpretable Model-Agnostic Explanations (LIME) in this study allowed for a deeper level of understanding of model predictions as well as provided viable alternative ways to overcome the challenges associated with black-box classifiers. Using a soft-voting ensemble technique that combined representations for Random Forest (RF), Decision Tree (DT), and Support Vector Machines (SVM) was applied to evaluate a publicly available heart disease dataset, containing 5110 records with each record containing 76 attributes. A total of 14 clinically relevant features were identified and evaluated using an 80/20 train-test split for the experimental setup, with results further validated by 5-fold cross-validation. The proposed soft-voting ensemble model achieved an accuracy of 89.10%, precision of 83.90%, recall of 95.20%, and F1-score of 89.90%, out-performing all individual baseline models and many of the recent XAI-enhanced deep learning models. The combination of SHAP and LIME allowed for both global and local interpretations of the model’s outputs, providing interpretable insights as to features like cp, thal, ca, and oldpeak contributed to the predictions and aligning these features with known cardiovascular risk factors. The results of this research demonstrate how interpretable (or explainable) ensemble-learning mechanisms can confer highly reliable, clinically useful heart disease risk predictions.

Introduction: The integration of Artificial Intelligence (AI) into personalized banking has enhanced service delivery in areas such as loan processing, credit assessment, and fraud detection. Despite these advancements, ethical concerns, especially algorithmic bias and lack of fairness, pose significant challenges. This study addresses the need for equitable AI systems that promote transparency, fairness, and regulatory compliance in the banking sector. Objective: This study aims to develop and implement a comprehensive framework for integrating ethical principles into AI-driven banking systems, with a focus on mitigating algorithmic bias, enhancing fairness, and improving transparency in personalized banking services. Methods: A comprehensive methodology is proposed that integrates bias-aware data collection, fairness-constrained machine-learning models, and explainable AI (XAI) techniques. Tools such as Shapley Additive Explanations (SHAPs) and Local Interpretable Model-Agnostic Explanations (LIMEs) are applied to interpret model outputs. Adversarial debiasing and fairness-aware learning algorithms were employed to identify and mitigate systemic biases in financial data. Alternative data sources, including utility and rental payment histories, were incorporated to enhance inclusivity. Results: The implementation of the proposed framework demonstrates improved fairness in decision-making without significantly compromising model accuracy. Bias metrics show measurable reductions in disparate impacts across the demographic groups. Explainability tools enhance transparency, enabling a more transparent communication of AI decisions to both users and regulators. Conclusions: Embedding ethical principles into AI-driven banking systems is critical to ensuring fairness, regulatory alignment, and public trust. The structured framework presented in this study supports the development of responsible AI systems to mitigate bias, enhance explainability, and foster financial inclusion. This approach serves as the foundation for building equitable and accountable AI applications in modern banking.

Introduction: The connection between green innovation and firm performance on the industrial sector of Pakistan is explored by this study, which implements the versatile explainable artificial intelligence (XAI) approaches to reveal the knowledge path with transparent explanations of complex decisions. Objective: It adopts a comparative approach to SHAP (SHapley Additive exPlanations) and LIME (Local Interpretable Model-agnostic Explanations) model in explaining green innovation endeavors into an elucidation of practical business gains guaranteed. Method: On a large scale, study access a comprehensive dataset of 284 manufacturing companies of diverse industries within Pakistan and develop a machine learning model to forecast the firm indicators of performance whilst being interpretable using XAI methods. Results: Research has found that green innovation has a positive impact that is statistically significant on firm performance and the drivers which have been identified are described as environmental compliance, resource efficiency and sustainable product development. The above comparative analysis of SHAP and LIME shows that both methods, in their turn, yield good insights, but SHAP shows more consistent global explanations whereas LIME is better at explaining individual instances. Conclusions: By having the contribution in the growing literature on sustainable business practices in emerging markets, this research is practical in giving the right directions to policymakers and business leaders in Pakistan. Suggestions are given to the policy makers and the firms in Pakistan indicating that strategic investments need to be made in process innovation and regulatory frameworks. This study highlights the promise of XAI to help in de-mystifying the complex nature of relationships in sustainability-related performance.

Road traffic accidents represent an acute global issue, with approximately 1.19 million fatalities annually, demanding innovative solutions beyond traditional statistical approaches like Poisson and Negative Binomial regression models. This study presents a comprehensive theoretical framework that synergizes Artificial Intelligence (AI), fuzzy logic, and Systemic Safety Science through the Haddon Matrix to revolutionize accident prediction and prevention strategies. The study proposes a framework that employs advanced AI techniques, including Bayesian Long Short-Term Memory (LSTM) networks for temporal risk assessment, Graph Neural Networks (GNNs) for spatial relationship modeling, and XGBoost for feature importance analysis, which can process diverse data sources such as traffic patterns, weather conditions, and vehicle telemetry. Complementing these AI components, the chapter proposes a Mamdani-type fuzzy inference system that can translate predictive outputs into actionable safety measures like adaptive speed controls and collision warnings, effectively handling real-world uncertainties through interpretable linguistic rules. The Haddon Matrix provides the structural foundation, systematically organizing interventions across host (driver-related), agent (vehicle-related), and environmental factors throughout pre-crash, crash, and post-crash phases. The proposed MATLAB/Simulink-based implementation architecture incorporates data pipelines from Kaggle and HighD datasets, hybrid AI-fuzzy decision modules, and continuous feedback mechanisms for model refinement at five-second intervals. Notable innovations include enhanced explainability through Shapley Additive exPlanations (SHAP) and Local Interpretable Model-agnostic Explanations (LIME) techniques, adaptive learning capabilities for evolving traffic scenarios, and compliance with ISO 26262/5469 safety standards. While the framework demonstrates significant theoretical promise for intelligent transportation systems, it acknowledges practical challenges, including data privacy concerns, sensor reliability issues, and stringent real-time processing requirements with sub-500ms latency thresholds. Future research directions highlight the potential of edge computing, digital twin technology, and regulatory sandbox environments to bridge the gap between theoretical conception and practical deployment, ultimately aiming to create safer, more responsive transportation ecosystems that harmonize computational precision with a human-centric control paradigm.

This work focuses on applying explainable artificial intelligence (AI) techniques to improve the interpretability and reliability of models in two crucial scenarios: detecting collusion in public procurement auctions and identifying corruption in public contracts in Mexico. While these challenges are specific, the need for transparency and explainability in AI systems is universal, especially when it comes to high-impact government issues. Our analysis is based on case studies of these particular applications, highlighting how interpretability techniques such as SHAP (SHapley Additive exPlanations) and LIME (Local Interpretable Model-agnostic Explanations) can be used to provide crucial insights into decisions of the algorithms involved. In doing so, our paper seeks to contribute to a broader understanding of how explainable AI can be applied in diverse government contexts. Additionally, we explore the ethical and practical implications of explainable AI in governance, highlighting its ability to promote greater transparency, accountability, and trust in automated decisions. By the end of this study, we hope to provide a more comprehensive view on how explainable AI can be a valuable tool in improving public governance, not only in relation to cases of collusion and corruption, but also in a wide range of critical government applications.

Analysis of electrocardiograms (ECG) is vital to identify cardiological problems; however, traditional interpretation requires a lot of clinical knowledge and is influenced by inter-observer variability. In order to solve these problems, this research presents an interpretable deep learning framework that fuses Convolutional Neural Networks (CNN), Bidirectional Long Short-Term Memory (BiLSTM) networks, and an Attention mechanism for multi-label ECG classification. In addition to employing the PTB-XL dataset, the system commits to clinical trust by integrating explainability methods SHAP (SHapley Additive exPlanations) and LIME (Local Interpretable Model-Agnostic Explanations) to enhance transparency.The model reaches a macro F1-score of 0.369 and an ROC-AUC of 0.919, reflecting its high capability of simultaneous multi-class identification of different cardiac diseases. The SHAP Attention superposition helps in providing easy-to-understand explanations, which enable the doctor to see the time-related and shape-related factors of the ECG waveform.This paper focuses on the importance of combining accuracy with explanation in AI healthcare systems and provides a robust, transparent method for computer-assisted cardiac diagnosis.