Distributed Energy Resource (DER) environments rely on network communication protocols to coordinate control commands, measurements, and device states across edge assets and cloud systems. Edge anomaly detection systems (ADS) monitor this traffic to identify deviations from normal communication behavior, flagging suspicious flows for further investigation. When the ADS flags abnormal network traffic, a single attack label is often insufficient for operational response: the label reports the detector's selected class but does not expose alternative threat interpretations that may warrant investigation. This paper presents Cybersecurity Threat Reasoning with Explainable Artificial Intelligence (CyTReX), an evidence-grounded threat reasoning framework for DER security that transforms network-level anomaly alerts into ranked, analyst-facing threat hypotheses designed to support Security Operations Center (SOC) triage and investigation. CyTReX constrains large language model (LLM) reasoning through a structured evidence packet, defined as a consolidated record of detection outputs, model explanations, and cyber threat intelligence (CTI) context. The evidence packet integrates edge-layer anomaly detection evidence, cloud reasoning layer attack interpretation, Shapley Additive Explanations (SHAP) network-feature attributions, surrogate decision rules, and Model Context Protocol (MCP)-enabled CTI enrichment. This ensures that every ranked hypothesis and attack-tree branch is traceable to explicit evidence rather than free-form LLM inference, and that incomplete or conflicting evidence is communicated rather than suppressed. Evaluation across five configurations shows that additional reasoning components improve hypothesis specificity, evidence traceability, and analytical grounding, with the complete pipeline providing the richest evidence-grounded reasoning context.
Figures & tables
Fig. 1: Representative DER-integrated grid communication architecture and attack surfaces [ 9 ] .
Framework / Approach
ML Anomaly Detection
Explainable AI (XAI)
CTI Enrichment
LLM-Assisted Reasoning
Ranked Hypotheses
Grid/Industrial Control Systems (ICS) Focus
ML-Based Anomaly Detection System (ML-ADS) [ 3 ]
✓
×
×
×
×
✓
CySIDER [ 15 ]
✓
×
✓
×
×
✓
XAI-Forensic Intrusion Detection System (IDS) [ 5 ]
✓
✓
×
×
×
×
ExCyDER [ 16 ]
✓
✓
×
×
×
✓
LLM Cybersecurity Survey [ 17 ]
×
×
✓
✓
×
×
SEvenLLM [ 18 ]
×
×
✓
✓
×
×
TABLE I: Comparison of Cybersecurity Threat Reasoning and Analysis Frameworks
Fig. 2: CyTReX framework showing transmission of edge-generated alert evidence to the cloud for evidence-grounded threat reasoning and hypothesis generation
Fig. 3: Experimental setup showing DER devices transmitting DNP3 packets to edge devices, with edge-to-cloud communication, MCP-enabled CTI retrieval, and cloud-based threat reasoning through the Streamlit engine.
Label
Use in this study
Meaning in DNP3 context
NORMAL
Benign baseline
Expected DNP3 communication behavior.
REPLAY
Trained attack
Replay of DNP3 packets previously captured from a legitimate DNP3 master or outstation.
COLD_RESTART
Trained attack
A malicious master-like entity sends the DNP3 cold-restart function code, causing the target outstation to initiate a complete restart.
WARM_RESTART
Trained attack
A malicious master-like entity sends the DNP3 warm-restart function code, causing a partial restart or reinitialization of the DNP3 service.
STOP_APP
Trained attack
A stop-application command associated with DNP3 Function Code 18 asks the slave/outstation to stop a function so it cannot continue receiving messages from the master.
DISABLE_UNSOLICITED
Trained attack
A command associated with DNP3 Function Code 21 disables unsolicited messages from the target outstation.
TABLE II: Dataset labels in the DNP3 case study.
Tool
Purpose
extract_evidence_terms
Extracts CTI query terms from edge, cloud, SHAP, rule, and flow evidence.
query_mitre_attack_ics
Retrieves MITRE ATT&CK for ICS techniques, tactics, STIX relationships, and official mitigations.
query_capec_patterns
Retrieves CAPEC attack-pattern context from the CAPEC Extensible Markup Language (XML) corpus.
The rapid growth of Distributed Energy Resources (DERs) has significantly expanded the cyber attack surface of modern power grids. Furthermore, increasing sophistication in attack techniques demands anomaly detection systems (ADS) that are accurate, interpretable, and reliable to support DER cybersecurity. While ML-based ADS provide strong detection capabilities, their black-box nature reduces operator trust and limits Security Operation Center's (SOC) ability to effectively interpret alerts and respond, highlighting the need for explainable Artificial Intelligence (XAI) to ensure transparency and operational confidence. This paper presents an XAI-based anomaly detection framework tailored for DER networks (ExCYDER). The proposed framework uses a self-verifying mechanism that validates ADS alerts to ensure trustworthy decision-making. ExCYDER combines LightGBM with SHAP to check whether each model decision aligns with its feature-attribution evidence, allowing the system to confirm that its internal reasoning is consistent and reliable. Experiments on a realistic DNP3 dataset achieved over 98% detection accuracy, an average rule--SHAP consistency of 44.6%, a SHAP latency of 14.5 ms per alert, and a confidence deviation within 5%, demonstrating stable verification behavior with minimal computational overhead. The framework distinguished between coherent and inconsistent alerts without compromising detection accuracy, demonstrating that integrated verification within XAI-based ADS enhances interpretability, auditability, and operational robustness for DER-focused SOCs.
Security operations centers rely on anomaly detection systems to flag suspicious events. Feature-level explanations for anomaly detectors offer limited value for operational investigations. To effectively handle alerts, analysts need to know contextual relationships and need actionable understanding of the entities involved. This paper introduces an event-centric detector-agnostic approach for explaining cybersecurity alerts in small- to medium-sized enterprise networks. We present (EC)2, a multi-agent framework that performs structured, hypothesis-driven investigation to provide explanations grounded in verifiable evidence. Evaluation results show that the proposed framework improves post-detection analysis by generating operationally meaningful explanations, which also enhance event classification accuracy.
Neta Kirmayer, David Tayouri, Andrés Murillo +3
Ben-Gurion University of the Negev, Beer-Sheva, Israel · Fujitsu
A major issue in Security Operations Centers (SOCs) is alert fatigue, as the number of detections reported is more than staff can triage in a given day. Prior work prompts or fine-tunes large language models (LLMs) to emit a triage label directly, but does not train them to reason about whether a detection is a genuine threat. We train a chain-of-thought (CoT) reasoning-enabled triage classifier on real, human-labeled Windows endpoint detections by combining automated prompt optimization, self-training, and reinforcement learning with verifiable rewards. We find that CoT reasoning also degrades the label-token probabilities that automated triage relies on, so we separately train a calibrator that reads the full reasoning trace and estimates the probability that the verdict is correct. Our system reaches 82.6% test accuracy and, at the high-confidence operating point that governs automated triage, improves benign recall by 43.0% and malicious recall by 18.3% over a direct-label LLM classifier. We further show that the trained calibrator is necessary - an untrained confidence judge collapses high-confidence recall to zero - and that a finetuned 30B model significantly outperforms frontier general-purpose models, motivating targeted training over scale.
Amol Khanna, Manu Nandan, Cristian Viorel Popa +10