CyTReX: Explainable AI-Based Cybersecurity Threat Reasoning Framework for DER Networks

Damilola Popoola; Souradeep Bhattacharya; Manimaran Govindarasu

cs.CROct 3, 2026

CyTReX: Explainable AI-Based Cybersecurity Threat Reasoning Framework for DER Networks

Authors: Damilola Popoola, Souradeep Bhattacharya, Manimaran Govindarasu

Organizations: Department of Electrical and Computer Engineering Iowa State University, Ames, IA 50011

Abstract

Distributed Energy Resource (DER) environments rely on network communication protocols to coordinate control commands, measurements, and device states across edge assets and cloud systems. Edge anomaly detection systems (ADS) monitor this traffic to identify deviations from normal communication behavior, flagging suspicious flows for further investigation. When the ADS flags abnormal network traffic, a single attack label is often insufficient for operational response: the label reports the detector's selected class but does not expose alternative threat interpretations that may warrant investigation. This paper presents Cybersecurity Threat Reasoning with Explainable Artificial Intelligence (CyTReX), an evidence-grounded threat reasoning framework for DER security that transforms network-level anomaly alerts into ranked, analyst-facing threat hypotheses designed to support Security Operations Center (SOC) triage and investigation. CyTReX constrains large language model (LLM) reasoning through a structured evidence packet, defined as a consolidated record of detection outputs, model explanations, and cyber threat intelligence (CTI) context. The evidence packet integrates edge-layer anomaly detection evidence, cloud reasoning layer attack interpretation, Shapley Additive Explanations (SHAP) network-feature attributions, surrogate decision rules, and Model Context Protocol (MCP)-enabled CTI enrichment. This ensures that every ranked hypothesis and attack-tree branch is traceable to explicit evidence rather than free-form LLM inference, and that incomplete or conflicting evidence is communicated rather than suppressed. Evaluation across five configurations shows that additional reasoning components improve hypothesis specificity, evidence traceability, and analytical grounding, with the complete pipeline providing the richest evidence-grounded reasoning context.

Figures & tables

Fig. 1: Representative DER-integrated grid communication architecture and attack surfaces [ 9 ] .

Framework / Approach	ML Anomaly Detection	Explainable AI (XAI)	CTI Enrichment	LLM-Assisted Reasoning	Ranked Hypotheses	Grid/Industrial Control Systems (ICS) Focus
ML-Based Anomaly Detection System (ML-ADS) [ 3 ]	$\checkmark$	$\times$	$\times$	$\times$	$\times$	$\checkmark$
CySIDER [ 15 ]	$\checkmark$	$\times$	$\checkmark$	$\times$	$\times$	$\checkmark$
XAI-Forensic Intrusion Detection System (IDS) [ 5 ]	$\checkmark$	$\checkmark$	$\times$	$\times$	$\times$	$\times$
ExCyDER [ 16 ]	$\checkmark$	$\checkmark$	$\times$	$\times$	$\times$	$\checkmark$
LLM Cybersecurity Survey [ 17 ]	$\times$	$\times$	$\checkmark$	$\checkmark$	$\times$	$\times$
SEvenLLM [ 18 ]	$\times$	$\times$	$\checkmark$	$\checkmark$	$\times$	$\times$

TABLE I: Comparison of Cybersecurity Threat Reasoning and Analysis Frameworks

Fig. 2: CyTReX framework showing transmission of edge-generated alert evidence to the cloud for evidence-grounded threat reasoning and hypothesis generation

Fig. 3: Experimental setup showing DER devices transmitting DNP3 packets to edge devices, with edge-to-cloud communication, MCP-enabled CTI retrieval, and cloud-based threat reasoning through the Streamlit engine.

Label	Use in this study	Meaning in DNP3 context
NORMAL	Benign baseline	Expected DNP3 communication behavior.
REPLAY	Trained attack	Replay of DNP3 packets previously captured from a legitimate DNP3 master or outstation.
COLD_RESTART	Trained attack	A malicious master-like entity sends the DNP3 cold-restart function code, causing the target outstation to initiate a complete restart.
WARM_RESTART	Trained attack	A malicious master-like entity sends the DNP3 warm-restart function code, causing a partial restart or reinitialization of the DNP3 service.
STOP_APP	Trained attack	A stop-application command associated with DNP3 Function Code 18 asks the slave/outstation to stop a function so it cannot continue receiving messages from the master.
DISABLE_UNSOLICITED	Trained attack	A command associated with DNP3 Function Code 21 disables unsolicited messages from the target outstation.

TABLE II: Dataset labels in the DNP3 case study.

Tool	Purpose
extract_evidence_terms	Extracts CTI query terms from edge, cloud, SHAP, rule, and flow evidence.
query_mitre_attack_ics	Retrieves MITRE ATT&CK for ICS techniques, tactics, STIX relationships, and official mitigations.
query_capec_patterns	Retrieves CAPEC attack-pattern context from the CAPEC Extensible Markup Language (XML) corpus.
retrieve_full_cti_context	Orchestrates evidence-term extraction, MITRE retrieval, CAPEC retrieval, normalization, and provenance recording.

TABLE III: MCP-enabled CTI tools used in the evaluation.

Config.	Configuration	Purpose
C1	Edge-only: Edge evidence + LLM	Tests whether edge anomaly evidence alone supports attack-tree generation.
C2	Edge-only: Edge evidence + CTI + LLM	Tests whether CTI enriches edge-only reasoning without cloud reasoning layer attack interpretation.
C3	Full pipeline: Edge evidence + cloud reasoning layer attack interpretation + LLM	Tests the effect of cloud reasoning layer attack interpretation.
C4	Full pipeline: Edge evidence + cloud reasoning layer attack interpretation + Rule-SHAP + LLM	Tests whether model explanation features improves evidence support.
C5	Complete pipeline: Edge evidence + cloud + Rule-SHAP + CTI + LLM	Tests the complete evidence-grounded reasoning workflow.

TABLE IV: Five-configuration evaluation design.

Attack label	Result	C1	C2	C3	C4	C5
COLD_RESTART	H1	DNP3 replay	Rogue master	Cold restart	Cold restart	Denial of service
	Latency	152.06 s	180.74 s	138.85 s	117.95 s	160.33 s
DISABLE_UNSOLICITED	H1	Command replay	Distributed denial-of-service (DDoS) attack	Disable unsolicited	Cold restart	DNP3 replay
	Latency	135.82 s	182.78 s	122.78 s	151.20 s	134.18 s
INIT_DATA	H1	Rogue master	Denial of service	Rogue master	Cold restart	DNP3 replay
	Latency	150.28 s	157.64 s	142.43 s	176.39 s	133.37 s

TABLE V: Overview of generated highest-ranked (H1) hypotheses and latency across trained DNP3 attack labels.

Layer	Model	Acc.	Prec.	Rec.	F1
Edge	Isolation Forest+Nearest Neighbor	98.43	99.04	99.37	99.21
Edge	Isolation Forest	97.93	98.98	98.85	98.91
Edge	Extended Isolation Forest	57.52	98.50	56.26	71.61
Cloud	LightGBM	99.58	99.58	99.58	99.58
Cloud	Extreme Gradient Boosting (XGBoost)	99.08	99.10	99.08	99.08
Cloud	Random Forest	85.79	88.31	85.80	85.32

TABLE VI: ML model selection results for edge and cloud reasoning layers.

OOD label	Result	C2	C5
DNP3_ENUM	H1	Parameter manipulation	DNP3 replay
	H2	Data collection	Denial of service
	H3	Process disruption	Rogue master injection
	Latency	153.00 s	136.15 s
DNP3_INFO	H1	Parameter manipulation	DNP3 replay
	H2	Initial access attempt	DNP3 spoofing

TABLE VII: OOD reasoning results for held-out DNP3 labels.

Panel of Figure 11 — Fig. 4: Compact evidence-grounded attack-tree representation for the REPLAY case, showing the root event, ranked threat hypotheses, supporting evidence, MITRE ATT&CK for ICS techniques, CAPEC patterns, and mitigation context.

Cybersecurity

Cybersecurity develops methods to protect digital and cyber-physical systems from attacks, vulnerabilities, data loss, and misuse.

See all 354 papers

Self-Verifying Anomaly Detection using Explainable AI for Cybersecurity of DER Networks
Sep 11, 2026Damilola Popoola, Souradeep Bhattacharya, Manimaran GovindarasuCyber-Physical Systems Network Intrusion Detection
Department of Electrical and Computer Engineering Iowa State University, Ames, IA 50011
(EC)2: Event-Centric Explainability for Cybersecurity Through Multi-Agent LLM Investigations
Jul 28, 2026Neta Kirmayer, David Tayouri, Andrés Murillo +3Multi-Agent LLM Systems Explainable Artificial Intelligence
Ben-Gurion University of the Negev, Beer-Sheva, Israel · Fujitsu
Cybersecurity Detection Classification with Reasoning-enabled Language Models
Jul 30, 2026Amol Khanna, Manu Nandan, Cristian Viorel Popa +10CoT Reasoning Language Model Calibration
CrowdStrike

Sep 11, 2026J/K move · Enter open · S save

Self-Verifying Anomaly Detection using Explainable AI for Cybersecurity of DER Networks

Damilola Popoola, Souradeep Bhattacharya, Manimaran Govindarasu

Department of Electrical and Computer Engineering Iowa State University, Ames, IA 50011

Cyber-Physical Systems Network Intrusion Detection Interpretable Anomaly Detection Cybersecurity

Open paper AskPDF arXiv

The rapid growth of Distributed Energy Resources (DERs) has significantly expanded the cyber attack surface of modern power grids. Furthermore, increasing sophistication in attack techniques demands anomaly detection systems (ADS) that are accurate, interpretable, and reliable to support DER cybersecurity. While ML-based ADS provide strong detection capabilities, their black-box nature reduces operator trust and limits Security Operation Center's (SOC) ability to effectively interpret alerts and respond, highlighting the need for explainable Artificial Intelligence (XAI) to ensure transparency and operational confidence. This paper presents an XAI-based anomaly detection framework tailored for DER networks (ExCYDER). The proposed framework uses a self-verifying mechanism that validates ADS alerts to ensure trustworthy decision-making. ExCYDER combines LightGBM with SHAP to check whether each model decision aligns with its feature-attribution evidence, allowing the system to confirm that its internal reasoning is consistent and reliable. Experiments on a realistic DNP3 dataset achieved over 98% detection accuracy, an average rule--SHAP consistency of 44.6%, a SHAP latency of 14.5 ms per alert, and a confidence deviation within 5%, demonstrating stable verification behavior with minimal computational overhead. The framework distinguished between coherent and inconsistent alerts without compromising detection accuracy, demonstrating that integrated verification within XAI-based ADS enhances interpretability, auditability, and operational robustness for DER-focused SOCs.

Abstract

Cybersecurity

Explore similar work

Self-Verifying Anomaly Detection using Explainable AI for Cybersecurity of DER Networks

(EC)2: Event-Centric Explainability for Cybersecurity Through Multi-Agent LLM Investigations

Cybersecurity Detection Classification with Reasoning-enabled Language Models