Towards Explicable Cybersecurity: Integrating Explicability into Bert and GPT Models for Incident Detection and Analysis

Abstract

Introduction: The effectiveness of artificial intelligence models for cybersecurity, such as BERT and GPT, has been demonstrated in threat detection and automated report generation. However, the lack of explicability undermines analysts' confidence and hinders the adoption of these tools in critical contexts. This article proposes an integrated approach to explainability (XAI) applied to BERT and GPT, aimed at providing interpretable explanations for decisions taken: highlighting trigger tokens, visualizing attention weights, and semantically justifying recommendations.

Through experimentation on the CIC-IDS2017 dataset, we show that the integration of an XAI module improves the readability of alerts, the traceability of decisions and the effectiveness of responses. This work paves the way for more transparent, understandable and collaborative cybersecurity between AI and human experts.

Objectives: Address AI opacity in cybersecurity, Provide interpretable explanations: To deliver transparent decision explanations by highlighting trigger tokens, visualizing attention weights, and generating semantic justifications for AI recommendations

Methods: The research developed a hybrid XAI-BERT-GPT architecture that combines BERT for threat classification with GPT for report generation, integrated with explainability techniques including attention visualization, LIME, and SHAP. The system was evaluated using the CIC-IDS2017 dataset containing over 3 million network connections with various cyber-attacks. The experimental design included both quantitative performance metrics (accuracy, recall, F1-score) and qualitative evaluation by 10 cybersecurity analysts. The implementation used BERT-base-uncased fine-tuned with PyTorch, GPT-2 for text generation, and specialized libraries (Captum, SHAP) for explainability analysis.

Results: The XAI integration caused only minimal performance degradation (accuracy decreased <0.3% from 96.8% to 96.5%) while reducing false positives from 2.8% to 2.5%. GPT-generated reports received high analyst ratings (4.1-4.6/5) for technical relevance, clarity, and consistency. Most significantly, explainability dramatically improved human analyst performance: confidence in AI decisions increased from 58% to 84%, analysis time per log decreased from 78s to 42s, and willingness to recommend the tool rose from 6/10 to 9/10. The study demonstrated that explainability enhances human-AI collaboration and operational efficiency without compromising detection accuracy.

Conclusions: This research successfully demonstrates that integrating explainability into AI cybersecurity systems enhances human-AI collaboration without compromising detection performance, achieving 96.5% accuracy while dramatically improving analyst confidence (58% to 84%) and decision speed (78s to 42s per log). The XAI-BERT-GPT architecture proves that sophisticated AI models can be both powerful and transparent, challenging the traditional trade-off between complexity and interpretability. The findings establish that explainability is not merely a regulatory requirement but a performance enhancer that accelerates incident response and builds essential human trust in critical security contexts. This work paves the way for more resilient, transparent, and trustworthy cybersecurity infrastructure where AI power and human insight work synergistically to protect our digital world.