{"id":"https://openalex.org/W4317859637","doi":"https://doi.org/10.2172/2002491","title":"Explainable AI in Cybersecurity Operations: Lessons Learned from xAI Tool Deployment","display_name":"Explainable AI in Cybersecurity Operations: Lessons Learned from xAI Tool Deployment","publication_year":2022,"publication_date":"2022-01-01","ids":{"openalex":"https://openalex.org/W4317859637","doi":"https://doi.org/10.2172/2002491"},"language":"en","primary_location":{"id":"doi:10.14722/usec.2022.23014","doi":"https://doi.org/10.14722/usec.2022.23014","is_oa":true,"landing_page_url":"https://doi.org/10.14722/usec.2022.23014","pdf_url":"https://doi.org/10.14722/usec.2022.23014","source":{"id":"https://openalex.org/S7407105095","display_name":"Workshop on Usable Security (USEC)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings 2022 Symposium on Usable Security","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"bronze","oa_url":"https://doi.org/10.14722/usec.2022.23014","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5035672086","display_name":"Megan Nyre-Yu","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4210104735","display_name":"Sandia National Laboratories","ror":"https://ror.org/01apwpt12","country_code":"US","type":"facility","lineage":["https://openalex.org/I1330989302","https://openalex.org/I198811213","https://openalex.org/I4210104735"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Megan Nyre-Yu","raw_affiliation_strings":["Statistics and Human Systems Sandia National Laboratories"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Statistics and Human Systems Sandia National Laboratories","institution_ids":["https://openalex.org/I4210104735"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Elizabeth Morris","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4210104735","display_name":"Sandia National Laboratories","ror":"https://ror.org/01apwpt12","country_code":"US","type":"facility","lineage":["https://openalex.org/I1330989302","https://openalex.org/I198811213","https://openalex.org/I4210104735"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Elizabeth Morris","raw_affiliation_strings":["Statistics and Human Systems Sandia National Laboratories"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Statistics and Human Systems Sandia National Laboratories","institution_ids":["https://openalex.org/I4210104735"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102021024","display_name":"Michael Smith","orcid":"https://orcid.org/0009-0007-1770-1822","observed_orcids":["https://orcid.org/0009-0007-1770-1822"]},"institutions":[{"id":"https://openalex.org/I192454743","display_name":"Sandia National Laboratories California","ror":"https://ror.org/058m7ey48","country_code":"US","type":"facility","lineage":["https://openalex.org/I1330989302","https://openalex.org/I192454743","https://openalex.org/I198811213","https://openalex.org/I4210104735"]},{"id":"https://openalex.org/I4210104735","display_name":"Sandia National Laboratories","ror":"https://ror.org/01apwpt12","country_code":"US","type":"facility","lineage":["https://openalex.org/I1330989302","https://openalex.org/I198811213","https://openalex.org/I4210104735"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Michael Smith","raw_affiliation_strings":["All- Source Analytics Sandia National Laboratories","Sandia National Laboratories"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"All- Source Analytics Sandia National Laboratories","institution_ids":["https://openalex.org/I4210104735"]},{"raw_affiliation_string":"Sandia National Laboratories","institution_ids":["https://openalex.org/I192454743","https://openalex.org/I4210104735"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5059461113","display_name":"Blake Moss","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I192454743","display_name":"Sandia National Laboratories California","ror":"https://ror.org/058m7ey48","country_code":"US","type":"facility","lineage":["https://openalex.org/I1330989302","https://openalex.org/I192454743","https://openalex.org/I198811213","https://openalex.org/I4210104735"]},{"id":"https://openalex.org/I4210104735","display_name":"Sandia National Laboratories","ror":"https://ror.org/01apwpt12","country_code":"US","type":"facility","lineage":["https://openalex.org/I1330989302","https://openalex.org/I198811213","https://openalex.org/I4210104735"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Blake Moss","raw_affiliation_strings":["Cyber Security Technologies","Sandia National Laboratories","Cyber Security Technologies Sandia National Laboratories"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Cyber Security Technologies","institution_ids":[]},{"raw_affiliation_string":"Sandia National Laboratories","institution_ids":["https://openalex.org/I192454743","https://openalex.org/I4210104735"]},{"raw_affiliation_string":"Cyber Security Technologies Sandia National Laboratories","institution_ids":["https://openalex.org/I4210104735"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5030452214","display_name":"Charles Smutz","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I192454743","display_name":"Sandia National Laboratories California","ror":"https://ror.org/058m7ey48","country_code":"US","type":"facility","lineage":["https://openalex.org/I1330989302","https://openalex.org/I192454743","https://openalex.org/I198811213","https://openalex.org/I4210104735"]},{"id":"https://openalex.org/I4210104735","display_name":"Sandia National Laboratories","ror":"https://ror.org/01apwpt12","country_code":"US","type":"facility","lineage":["https://openalex.org/I1330989302","https://openalex.org/I198811213","https://openalex.org/I4210104735"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Charles Smutz","raw_affiliation_strings":["Cyber Security Technologies","Sandia National Laboratories","Cyber Security Technologies Sandia National Laboratories"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Cyber Security Technologies","institution_ids":[]},{"raw_affiliation_string":"Sandia National Laboratories","institution_ids":["https://openalex.org/I192454743","https://openalex.org/I4210104735"]},{"raw_affiliation_string":"Cyber Security Technologies Sandia National Laboratories","institution_ids":["https://openalex.org/I4210104735"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.4667,"has_fulltext":true,"cited_by_count":22,"citation_normalized_percentile":{"value":0.85296019,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":95,"max":99},"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.9976000189781189,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.9976000189781189,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.0008999999845400453,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.0003000000142492354,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/explainable-ai","display_name":"explainable AI","score":0.972000002861023},{"id":"https://openalex.org/keywords/cybersecurity-operations","display_name":"cybersecurity operations","score":0.9819999933242798},{"id":"https://openalex.org/keywords/trust-in-ai","display_name":"trust in AI","score":0.9259999990463257},{"id":"https://openalex.org/keywords/artificial-intelligence-adoption","display_name":"artificial intelligence adoption","score":0.414000004529953},{"id":"https://openalex.org/keywords/network-attack-detection","display_name":"network attack detection","score":0.6480000019073486},{"id":"https://openalex.org/keywords/security-event-analysis","display_name":"security event analysis","score":0.5249999761581421},{"id":"https://openalex.org/keywords/user-workflow","display_name":"user workflow","score":0.47200000286102295}],"concepts":[{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.8298221826553345},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6686971187591553},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5773922801017761},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.2679641842842102}],"mesh":[],"locations_count":4,"locations":[{"id":"doi:10.14722/usec.2022.23014","doi":"https://doi.org/10.14722/usec.2022.23014","is_oa":true,"landing_page_url":"https://doi.org/10.14722/usec.2022.23014","pdf_url":"https://doi.org/10.14722/usec.2022.23014","source":{"id":"https://openalex.org/S7407105095","display_name":"Workshop on Usable Security (USEC)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings 2022 Symposium on Usable Security","raw_type":"proceedings-article"},{"id":"doi:10.2172/2002491","doi":"https://doi.org/10.2172/2002491","is_oa":true,"landing_page_url":"https://doi.org/10.2172/2002491","pdf_url":"http://dx.doi.org/10.2172/2002491","source":{"id":"https://openalex.org/S4306402487","display_name":"OSTI OAI (U.S. Department of Energy Office of Scientific and Technical Information)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I139351228","host_organization_name":"Office of Scientific and Technical Information","host_organization_lineage":["https://openalex.org/I139351228"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proposed for presentation at the Usable Security and Privacy (USEC) Symposium 2022 held April 28-28, 2022 in San Diego, CA.","raw_type":"proceedings-article"},{"id":"pmh:oai:osti.gov:2002491","doi":null,"is_oa":true,"landing_page_url":"https://www.osti.gov/biblio/2002491","pdf_url":"https://www.osti.gov/servlets/purl/2002491","source":{"id":"https://openalex.org/S4306402487","display_name":"OSTI OAI (U.S. Department of Energy Office of Scientific and Technical Information)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I139351228","host_organization_name":"Office of Scientific and Technical Information","host_organization_lineage":["https://openalex.org/I139351228"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":null},{"id":"pmh:oai:osti.gov:2003124","doi":null,"is_oa":true,"landing_page_url":"https://www.osti.gov/biblio/2003124","pdf_url":"https://www.osti.gov/servlets/purl/2003124","source":{"id":"https://openalex.org/S4306402487","display_name":"OSTI OAI (U.S. Department of Energy Office of Scientific and Technical Information)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I139351228","host_organization_name":"Office of Scientific and Technical Information","host_organization_lineage":["https://openalex.org/I139351228"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":null}],"best_oa_location":{"id":"doi:10.14722/usec.2022.23014","doi":"https://doi.org/10.14722/usec.2022.23014","is_oa":true,"landing_page_url":"https://doi.org/10.14722/usec.2022.23014","pdf_url":"https://doi.org/10.14722/usec.2022.23014","source":{"id":"https://openalex.org/S7407105095","display_name":"Workshop on Usable Security (USEC)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings 2022 Symposium on Usable Security","raw_type":"proceedings-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[{"id":"https://openalex.org/G11630931","display_name":null,"funder_award_id":"DENA0003525","funder_id":"https://openalex.org/F4320306084","funder_display_name":"U.S. Department of Energy"},{"id":"https://openalex.org/G1859920734","display_name":null,"funder_award_id":"NA0003525","funder_id":"https://openalex.org/F4320337547","funder_display_name":"Laboratory Directed Research and Development"},{"id":"https://openalex.org/G2214935549","display_name":null,"funder_award_id":"NA0003525","funder_id":"https://openalex.org/F4320338291","funder_display_name":"Sandia National Laboratories"},{"id":"https://openalex.org/G413247060","display_name":null,"funder_award_id":"DE\u2010NA,0003525","funder_id":"https://openalex.org/F4320338291","funder_display_name":"Sandia National Laboratories"},{"id":"https://openalex.org/G4903105778","display_name":null,"funder_award_id":"NA0003525","funder_id":"https://openalex.org/F4320306084","funder_display_name":"U.S. Department of Energy"},{"id":"https://openalex.org/G5339743583","display_name":null,"funder_award_id":"NA0003525","funder_id":"https://openalex.org/F4320332369","funder_display_name":"National Nuclear Security Administration"},{"id":"https://openalex.org/G70797072","display_name":null,"funder_award_id":"DE-NA0003525","funder_id":"https://openalex.org/F4320337547","funder_display_name":"Laboratory Directed Research and Development"},{"id":"https://openalex.org/G8178004050","display_name":null,"funder_award_id":"contract DE-NA0003525","funder_id":"https://openalex.org/F4320332369","funder_display_name":"National Nuclear Security Administration"},{"id":"https://openalex.org/G855168022","display_name":null,"funder_award_id":"DENA-0003525","funder_id":"https://openalex.org/F4320332369","funder_display_name":"National Nuclear Security Administration"}],"funders":[{"id":"https://openalex.org/F4320306084","display_name":"U.S. Department of Energy","ror":"https://ror.org/01bj3aw27"},{"id":"https://openalex.org/F4320332369","display_name":"National Nuclear Security Administration","ror":"https://ror.org/03sk1we31"},{"id":"https://openalex.org/F4320337547","display_name":"Laboratory Directed Research and Development","ror":"https://ror.org/01e41cf67"},{"id":"https://openalex.org/F4320338291","display_name":"Sandia National Laboratories","ror":"https://ror.org/01apwpt12"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4317859637.pdf","grobid_xml":"https://content.openalex.org/works/W4317859637.grobid-xml"},"referenced_works_count":15,"referenced_works":["https://openalex.org/W1985987493","https://openalex.org/W2070901481","https://openalex.org/W2082190528","https://openalex.org/W2321770479","https://openalex.org/W2588978745","https://openalex.org/W2766343248","https://openalex.org/W2893622216","https://openalex.org/W2981731882","https://openalex.org/W2999615587","https://openalex.org/W3000471247","https://openalex.org/W3096432474","https://openalex.org/W3151279870","https://openalex.org/W3186379004","https://openalex.org/W6945423196","https://openalex.org/W7045384277"],"related_works":["https://openalex.org/W4323066309","https://openalex.org/W4402386085","https://openalex.org/W7019132735","https://openalex.org/W4409573889","https://openalex.org/W4281778452","https://openalex.org/W4294691140","https://openalex.org/W4411830688","https://openalex.org/W4409373925","https://openalex.org/W4415220299","https://openalex.org/W7167073235"],"abstract_inverted_index":{"MiTechnological":[0],"advances":[1],"relating":[2],"to":[3,40,49,53,91,94,130,151,174,215],"artificial":[4],"intelligence":[5],"(AI)":[6],"and":[7,32,44,57,65,70,82,88,103,125,136,155,177,198,212],"explainable":[8],"AI":[9,75,107],"(xAI)":[10],"techniques":[11,127],"are":[12,26],"at":[13],"a":[14,162],"stage":[15],"of":[16,22,42,59,159,200,205],"development":[17],"that":[18,169,194],"requires":[19],"better":[20],"understanding":[21],"operational":[23,55],"context.AI":[24],"tools":[25,146],"primarily":[27],"viewed":[28],"as":[29],"black":[30],"boxes":[31],"some":[33],"hesitation":[34],"exists":[35],"in":[36,97,106,115,133],"employing":[37],"them":[38],"due":[39],"lack":[41],"trust":[43,105,176,216],"transparency.xAI":[45],"technologies":[46],"largely":[47],"aim":[48],"overcome":[50],"these":[51],"issues":[52],"improve":[54,178,187],"efficiency":[56],"effectiveness":[58,158],"operators,":[60],"speeding":[61],"up":[62],"the":[63,145,157,196,201],"process":[64],"allowing":[66],"for":[67,120,148,165],"more":[68],"consistent":[69],"informed":[71],"decision":[72,189],"making":[73,137],"from":[74],"outputs.Such":[76],"efforts":[77],"require":[78],"not":[79,181],"only":[80],"robust":[81],"reliable":[83],"models":[84,124],"but":[85],"also":[86],"relevant":[87],"understandable":[89],"explanations":[90],"end":[92,206],"users":[93],"successfully":[95],"assist":[96],"achieving":[98],"user":[99],"goals,":[100],"reducing":[101],"bias,":[102],"improving":[104],"models.Cybersecurity":[108],"operations":[109,150],"settings":[110],"represent":[111],"one":[112],"such":[113],"context":[114],"which":[116],"automation":[117],"is":[118],"vital":[119],"maintaining":[121],"cyber":[122],"defenses.AI":[123],"xAI":[126,160,170,217],"were":[128,180,192],"developed":[129],"aid":[131],"analysts":[132],"identifying":[134],"events":[135,141],"decisions":[138],"about":[139],"flagged":[140],"(e.g.network":[142],"attack).We":[143],"instrumented":[144],"used":[147],"cybersecurity":[149],"unobtrusively":[152],"collect":[153],"data":[154],"evaluate":[156],"tools.During":[161],"pilot":[163],"study":[164],"deployment,":[166],"we":[167],"found":[168],"tools,":[171],"while":[172],"intended":[173],"increase":[175],"efficiency,":[179],"utilized":[182],"heavily,":[183],"nor":[184],"did":[185],"they":[186],"analyst":[188],"accuracy.Critical":[190],"lessons":[191],"learned":[193],"impact":[195],"utility":[197],"adoptability":[199],"technology,":[202],"including":[203],"consideration":[204],"users,":[207],"their":[208,210,213],"workflows,":[209],"environments,":[211],"propensity":[214],"outputs.":[218]},"counts_by_year":[{"year":2026,"cited_by_count":8},{"year":2025,"cited_by_count":4},{"year":2024,"cited_by_count":7},{"year":2023,"cited_by_count":3}],"updated_date":"2026-11-09T13:22:03.289127","created_date":"2023-01-25T00:00:00"}