Skip to content

Back to the catalog

CyTReX: Explainable AI-Based Cybersecurity Threat Reasoning Framework for DER Networks
arxiv.orgpaper

CyTReX: Explainable AI-Based Cybersecurity Threat Reasoning Framework for DER Networks

CyTReX is a proposed explainable-AI framework for Distributed Energy Resource (DER) network security that converts edge anomaly-detector alerts into ranked, evidence-traceable threat hypotheses for SOC analysts. It builds a structured "evidence packet" combining edge anomaly detection outputs, cloud-layer attack interpretation, SHAP feature attributions, surrogate decision rules, and Model Context Protocol-enabled cyber threat intelligence enrichment, constraining LLM reasoning so every ranked hypothesis and attack-tree branch is traceable to explicit evidence rather than free-form inference. The authors evaluate five pipeline configurations and show that adding reasoning components improves hypothesis specificity and evidence traceability for SOC triage/investigation.

TL;DR An evidence-grounded, explainable LLM framework that turns DER network anomaly alerts into ranked, SHAP/CTI-traceable threat hypotheses for SOC triage.
Open original ↗
Document

What it is

CyTReX is an experimental research pipeline (Iowa State University) that pairs a semi-supervised edge anomaly detector with a cloud-side supervised classifier and a local LLM (llama3.1:8b via Ollama) to turn DNP3 DER-network alerts into ranked attack-tree hypotheses. It's a case-study prototype, not a shipped tool.

How it works

Edge devices emit DNP3 traffic; a semi-supervised detector flags abnormal flows and batches them as JSON for the cloud layer. The cloud layer runs a supervised classifier for attack-class interpretation, SHAP for feature attribution, and surrogate decision rules as a consistency check against SHAP (producing an "evidence-quality signal"). A CTI layer retrieves context via an MCP-enabled interface from MITRE ATT&CK for ICS (techniques/mitigations) and CAPEC (attack patterns). All of this is assembled into a single "evidence packet" that constrains the LLM, which then generates the attack tree — root event, ranked hypotheses, supporting evidence, uncertainty notes, and evidence gaps.

flowchart LR
    A[DNP3 edge anomaly detector] --> B[Cloud supervised classifier]
    B --> C[SHAP attribution]
    B --> D[Surrogate rules]
    C --> E[Evidence-quality signal]
    D --> E
    F[MCP: ATT&CK for ICS + CAPEC] --> G[Unified evidence packet]
    E --> G
    B --> G
    G --> H[LLM: llama3.1:8b]
    H --> I[Ranked attack tree + evidence gaps]

Preconditions / Affected

Evaluated on a DNP3-based communication dataset [33], with the supervised classifier trained on six attack labels plus normal traffic. Two labels — DNP3_ENUM and DNP3_INFO — were deliberately excluded from training and used as held-out out-of-distribution cases to test reconnaissance-style detection. Hardware: Apple M4, 16GB RAM, macOS 15.5, Python 3.13, Streamlit UI, local Ollama backend.

What to do

Nothing operational — no patch, detection rule, or deployable artifact is given. The paper's contribution is architectural: if building SOC tooling for DER/DNP3 environments, the reusable idea is the evidence-packet pattern (edge evidence + cloud classifier output + SHAP + surrogate rules + MCP-retrieved CTI, all passed to an LLM under a single consistent prompt structure) rather than letting the LLM free-reason from a bare alert label.

Caveats

The fetched text cuts off mid-results (Section V, "A representative edge-device alert batch is used across all c...") before reporting the actual comparative numbers across the five configurations, so no concrete specificity/traceability metrics are available from this excerpt. All testing used a single fixed LLM (llama3.1:8b) across configurations — the authors note this isolates the effect of evidence components but it also means no cross-model validation is reported.

Technologies named here

Techniques named here

  • Network-level anomaly detection
  • Surrogate decision rules
  • Attack-tree based threat hypothesis ranking
  • Cloud reasoning layer attack interpretation

Related in AI Security