EXPLAINABLE AI FOR AUTONOMOUS CYBER THREAT DETECTION USING GRAPH NEURAL NETWORKS AND LARGE LANGUAGE MODELS

Abstract

The rapid expansion of interconnected digital infrastructures has significantly increased the complexity, volume, and sophistication of cyber threats. Conventional intrusion detection systems frequently depend on predefined signatures, manually engineered features, or isolated machine-learning models, limiting their ability to recognize evolving and previously unseen attack behaviors. At the same time, deep-learning-based cybersecurity systems can provide strong detection capabilities while offering limited explanations regarding why a particular event is considered malicious. This paper proposes an Explainable Artificial Intelligence (XAI) framework for autonomous cyber threat detection that integrates Graph Neural Networks (GNNs) with Large Language Models (LLMs). The proposed architecture represents network entities and their interactions as dynamic graphs, enabling GNNs to identify structural, behavioral, and temporal attack patterns. The resulting graph embeddings, threat scores, and security events are subsequently supplied to an LLM-based reasoning layer, which correlates alerts with contextual information and generates human-readable explanations. An XAI layer further identifies influential nodes, edges, features, and behavioral patterns responsible for the detection decision. The framework incorporates a threat-intelligence knowledge base based on structured cybersecurity information such as MITRE ATT&CK techniques and supports autonomous alert prioritization, incident summarization, and response recommendation. A security guardrail layer is proposed to reduce hallucination, prompt injection, unsafe automated actions, and unauthorized response behavior. The research establishes an evaluation methodology covering detection accuracy, precision, recall, F1-score, false-positive rate, detection latency, explanation fidelity, explanation consistency, LLM hallucination rate, computational cost, and autonomous-response reliability. The proposed framework aims to bridge the gap between high-performance graph-based threat detection and human-understandable cybersecurity reasoning, providing a foundation for trustworthy, explainable, and semi-autonomous cyber defense.