DeepXplain: XAI-Guided Autonomous Defense Against Multi-Stage APT Campaigns

Trung V. Phan; Thomas Bauschert

cs.CRMar 22, 2026

DeepXplain: XAI-Guided Autonomous Defense Against Multi-Stage APT Campaigns

Authors: Trung V. Phan, Thomas Bauschert

Organizations: Chair of Communication Networks, Technische Universität Chemnitz, 09126 Chemnitz, Germany

Abstract

Advanced Persistent Threats (APTs) are stealthy, multi-stage attacks that require adaptive and timely defense. While deep reinforcement learning (DRL) enables autonomous cyber defense, its decisions are often opaque and difficult to trust in operational environments. This paper presents DeepXplain, an explainable DRL framework for stage-aware APT defense. Building on our prior DeepStage model, DeepXplain integrates provenance-based graph learning, temporal stage estimation, and a unified XAI pipeline that provides structural, temporal, and policy-level explanations. Unlike post-hoc methods, explanation signals are incorporated directly into policy optimization through evidence alignment and confidence-aware reward shaping. To the best of our knowledge, DeepXplain is the first framework to integrate explanation signals into reinforcement learning for APT defense. Experiments in a realistic enterprise testbed show improvements in stage-weighted F1-score (0.887 to 0.915) and success rate (84.7% to 89.6%), along with higher explanation confidence (0.86), improved fidelity (0.79), and more compact explanations (0.31). These results demonstrate enhanced effectiveness and trustworthiness of autonomous cyber defense.

Figures & tables

Figure 1: Data and control flow of the DeepXplain framework. The red feedback path highlights how explanation signals are incorporated into policy optimization.

Method	Recon	InitAcc	PrivEsc	LatMov	C2	Exfil	Avg-F1	Success Rate (%)
Risk-Aware DRL	0.75	0.73	0.70	0.71	0.76	0.72	0.728	68.5
DeepStage	0.91	0.88	0.85	0.87	0.92	0.89	0.887	84.7
DeepXplain	0.93	0.91	0.89	0.90	0.94	0.92	0.915	89.6

Table I: Per-stage F1-score and overall defense effectiveness comparison.

Figure 2: Defense reaction versus APT stage progression.

Figure 3: Explanation quality comparison.

Variant	Avg. Stage-F1	Conf $(e_{t})$
DeepXplain w/o $\mathcal{L}_{align}$	0.900	0.79
DeepXplain w/o $\mathrm{Conf}(e_{t})$	0.910	0.74
DeepXplain (full)	0.915	0.86

Table II: Ablation study on XAI-guided optimization.

Autonomous Cyber Defense

Autonomous cyber defense uses AI agents to detect, investigate, and contain attacks while balancing operational safety, latency, and human oversight.

See all 69 papers

DeepStage: Learning Autonomous Defense Policies Against Multi-Stage APT Campaigns
Mar 17, 2026Trung V. Phan, Tri Gia Nguyen, Thomas BauschertAutonomous Cyber Defense
Chair of Communication Networks, Technische Universität Chemnitz, 09126 Chemnitz, Germany · Department of Information Assurance, FPT University, Da Nang 50509, Vietnam
Explainable Autonomous Cyber Defense using Adversarial Multi-Agent Reinforcement Learning
Apr 6, 2026Yiyao Zhang, Diksha Goel, Hussain AhmadAdversarial MARL Autonomous Cyber Defense
Adelaide University, Australia · CSIRO’s Data61, Australia
Trident : How to Break Deep Reinforcement Learning Cyber Defenses (Agentic)
Aug 5, 2026Ryozo Masukawa, Ian Bryant, Armita Kazeminajafabadi +6Autonomous Cyber Defense LLM Red Teaming
University of California, Irvine · Northeastern University · Johns Hopkins University

Mar 17, 2026J/K move · Enter open · S save

DeepStage: Learning Autonomous Defense Policies Against Multi-Stage APT Campaigns

Trung V. Phan, Tri Gia Nguyen, Thomas Bauschert

Chair of Communication Networks, Technische Universität Chemnitz, 09126 Chemnitz, Germany · Department of Information Assurance, FPT University, Da Nang 50509, Vietnam

Autonomous Cyber Defense

Open paper AskPDF arXiv

This paper presents DeepStage, a deep reinforcement learning (DRL) framework for adaptive and stage-aware defense against Advanced Persistent Threats (APTs). The enterprise environment is formulated as a partially observable Markov decision process (POMDP), in which host provenance and network telemetry are fused into unified provenance graphs. Building on our prior work (StageFinder), DeepStage employs a graph neural network encoder and an LSTM-based stage estimator to infer probabilistic attacker stages aligned with the MITRE ATT&CK framework. The resulting stage beliefs, together with graph embeddings, are used to guide a hierarchical Proximal Policy Optimization (PPO) agent that selects defense actions across monitoring, access control, containment, and remediation. Experiments in a realistic enterprise testbed with CALDERA-driven APT playbooks show that DeepStage achieves an average F1-score of 0.887 and a mitigation success rate of 84.7%, outperforming a risk-aware DRL baseline by 21.8% in F1-score and 16.2% in mitigation success. The results demonstrate effective stage-aware and cost-efficient autonomous cyber defense.

Abstract

Autonomous Cyber Defense

Explore similar work

DeepStage: Learning Autonomous Defense Policies Against Multi-Stage APT Campaigns

Explainable Autonomous Cyber Defense using Adversarial Multi-Agent Reinforcement Learning

Trident : How to Break Deep Reinforcement Learning Cyber Defenses (Agentic)