Explainable Artificial Intelligence for Industrial Cybersecurity: A Review of Methods, Operational Integration, and Research Challenges

arXiv:2609.00171 · cs.CR, cs.SY, eess.SY · Submitted 2026-08-31 · Read on arXiv

cs.CR, cs.SY, eess.SY

Submitted: 2026-08-31

Updated: 2026-08-31

Code: https://github.com/icsdataset/hai

Terminology

• Artificial Intelligence — 49× in this paper
• Interpretability — 34× in this paper · explained in 15 episodes
• Explainability — 29× in this paper · explained in 3 episodes
• Machine Learning — 22× in this paper
• Decision Tree — 16× in this paper
• Accountability — 15× in this paper · explained in 2 episodes
• Accuracy — 14× in this paper · explained in 1 episode
• Knowledge Graph — 13× in this paper · explained in 7 episodes
• Model-Agnostic — 11× in this paper · explained in 2 episodes
• Digital Twin — 10× in this paper · explained in 4 episodes
• Robustness — 9× in this paper · explained in 5 episodes
• Benchmark — 8× in this paper · explained in 2 episodes
• Knowledge graphs — 8× in this paper · explained in 2 episodes
• Trace — 8× in this paper · explained in 2 episodes
• Alignment — 7× in this paper · explained in 1 episode
• Fidelity — 7× in this paper · explained in 2 episodes
• Consistency — 6× in this paper · explained in 3 episodes
• Industrial Control Systems — 6× in this paper
• Operational Technology — 6× in this paper
• Reinforcement Learning — 5× in this paper · explained in 4 episodes
• Actor — 4× in this paper · explained in 3 episodes
• Core — 4× in this paper · explained in 2 episodes
• Foundation Model — 4× in this paper · explained in 3 episodes
• Foundation Models — 4× in this paper · explained in 7 episodes
• Generalization — 4× in this paper · explained in 13 episodes
• Local Interpretable Model-agnostic Explanations — 4× in this paper
• Physics-Informed Machine Learning — 4× in this paper
• Security Operations Centers — 4× in this paper
• Sparsity — 4× in this paper · explained in 4 episodes
• Alert Fatigue — 3× in this paper · explained in 1 episode
• Critical Infrastructure Protection — 3× in this paper
• Fine-Tuning — 3× in this paper · explained in 5 episodes
• Foundation Models (FMs) — 3× in this paper · explained in 2 episodes
• Indicators of Compromise — 3× in this paper
• Personalization — 3× in this paper · explained in 2 episodes
• Random Forest — 3× in this paper
• Reconstruction Error — 3× in this paper · explained in 2 episodes
• Actionability — 2× in this paper · explained in 3 episodes
• Artificial Intelligence (AI) — 2× in this paper · explained in 2 episodes
• Benchmarking — 2× in this paper · explained in 3 episodes
• Clustering — 2× in this paper · explained in 2 episodes
• Deep Neural Networks — 2× in this paper
• European Union — 2× in this paper
• Explainable AI (XAI) — 2× in this paper · explained in 7 episodes
• Federated Learning — 2× in this paper · explained in 14 episodes
• GNNs — 2× in this paper · explained in 2 episodes
• Hybrid Approach — 2× in this paper · explained in 4 episodes
• Iterative Refinement — 2× in this paper · explained in 3 episodes
• North American Electric Reliability Corporation — 2× in this paper
• Parsimony — 2× in this paper · explained in 2 episodes
• RAG — 2× in this paper · explained in 3 episodes
• SHAP values — 2× in this paper · explained in 2 episodes
• Transformer — 2× in this paper · explained in 2 episodes
• Abstraction — 1× in this paper · explained in 1 episode
• Accumulated Local Effects — 1× in this paper
• Adaptability — 1× in this paper · explained in 1 episode
• Adversarial Attacks — 1× in this paper · explained in 1 episode
• Adversarial Transferability — 1× in this paper · explained in 1 episode
• Agentic AI — 1× in this paper · explained in 1 episode
• Center for Security and Emerging Technology — 1× in this paper
• Chain-of-Thought (CoT) — 1× in this paper · explained in 4 episodes
• Chain-of-Thought (CoT) Prompting — 1× in this paper · explained in 3 episodes
• Cognitive Load — 1× in this paper · explained in 2 episodes
• Computational overhead — 1× in this paper · explained in 2 episodes
• Contrastive Explanation Method — 1× in this paper
• Convolutional Neural Networks (CNNs) — 1× in this paper · explained in 2 episodes
• Cooperation — 1× in this paper · explained in 2 episodes
• Cybersecurity and Infrastructure Security Agency — 1× in this paper
• DNN for Internet-of-Things — 1× in this paper
• Deep Reinforcement Learning — 1× in this paper · explained in 2 episodes
• Embeddings — 1× in this paper · explained in 2 episodes
• Ensemble Learning — 1× in this paper · explained in 2 episodes
• Feature Engineering — 1× in this paper · explained in 3 episodes
• Feature Selection — 1× in this paper · explained in 4 episodes
• Generative AI — 1× in this paper · explained in 2 episodes
• Graph Neural Networks (GNNs) — 1× in this paper · explained in 7 episodes
• Grounding — 1× in this paper · explained in 3 episodes
• Human-in-the-Loop — 1× in this paper · explained in 3 episodes
• Hybrid System — 1× in this paper · explained in 2 episodes
• Individual Conditional Expectancy — 1× in this paper
• Information Leakage — 1× in this paper · explained in 2 episodes
• International Conference on Machine Learning and Applications — 1× in this paper
• International Electrotechnical Commission — 1× in this paper
• LSTM and Gated Recurrent Unit — 1× in this paper
• Latent Space — 1× in this paper · explained in 7 episodes
• Light Gradient Boosting Machine — 1× in this paper
• Long Short-Term Memory — 1× in this paper
• Organisation for Economic Co-operation and Development — 1× in this paper
• Partial Dependence Plot — 1× in this paper
• Predictive Maintenance — 1× in this paper · explained in 2 episodes
• Principal Component Analysis (PCA) — 1× in this paper · explained in 4 episodes
• Pruning — 1× in this paper · explained in 4 episodes
• Reasoning Traces — 1× in this paper · explained in 3 episodes
• Regularization — 1× in this paper · explained in 3 episodes
• Reinforcement Learning (RL) — 1× in this paper · explained in 25 episodes
• Scaffolding — 1× in this paper · explained in 3 episodes
• Shapley values — 1× in this paper · explained in 2 episodes
• Support Vector Machine — 1× in this paper
• Transferability — 1× in this paper · explained in 4 episodes
• United States — 1× in this paper

Sources

• XAI for Cybersecurity: State of the Art, Challenges, Open Issues and Future Directions
• Evaluating explainable AI for deep learning-based network intrusion detection system alert classification
• Bridging the Gap in XAI-Why Reliable Metrics Matter for Explainability and Compliance
• A comprehensive analysis of PINNs: Variants, Applications, and Challenges
• Knowledge Graph Large Language Model (KG-LLM) for Link Prediction
• XAI meets LLMs: A Survey of the Relation between Explainable AI and Large Language Models

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs