Bridging the Black Box: Explainable Anomaly Detection for Critical Infrastructure Systems

Cyberattacks have become more frequent and complex, increasing the chance of malicious actors targeting infrastructure. Deep learning models have shown promise in being effective at detecting anomalies, but are generally uninterpretable. Our CIS framework seeks to incorporate Explainable AI (XAI) and knowledge graphs to make a more interpretable model that enhances the provided context of each detected anomaly, while balancing the predictive accuracy of deep learning models with the added XAI. It includes an ETL process that ingests network and sensor logs through a scalable pipeline powered by Spark, Kafka, TimescaleDB, and Neo4j graph databases. We deploy a graph neural network autoencoder for anomaly detection and an XAI framework, such as SHAP or GNNExplainer, to indicate the most influential features, nodes, and relationships from the graph.