{"id":"https://openalex.org/W7225411595","doi":"https://doi.org/10.63180/jjic.thestap.2027.1.5","title":"An Explainable AI Framework for Real-Time Cyberattack Detection and Risk Assessment","display_name":"An Explainable AI Framework for Real-Time Cyberattack Detection and Risk Assessment","publication_year":2026,"publication_date":"2026-11-06","ids":{"openalex":"https://openalex.org/W7225411595","doi":"https://doi.org/10.63180/jjic.thestap.2027.1.5"},"language":"en","primary_location":{"id":"doi:10.63180/jjic.thestap.2027.1.5","doi":"https://doi.org/10.63180/jjic.thestap.2027.1.5","is_oa":true,"landing_page_url":"https://doi.org/10.63180/jjic.thestap.2027.1.5","pdf_url":"https://thestap.blob.core.windows.net/jjic/articles/published/423441377342.pdf","source":{"id":"https://openalex.org/S5407049533","display_name":"Jordanian Journal of Informatics and Computing","issn_l":"3080-6828","issn":["3080-6828"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Jordanian Journal of Informatics and Computing","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://thestap.blob.core.windows.net/jjic/articles/published/423441377342.pdf","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5015373232","display_name":"Vugar Hacimahmud Abdullayev","orcid":"https://orcid.org/0000-0002-3348-2267","observed_orcids":["https://orcid.org/0000-0002-3348-2267"]},"institutions":[{"id":"https://openalex.org/I136806742","display_name":"Azerbaijan State Oil and Industry University","ror":"https://ror.org/05mmnns11","country_code":"AZ","type":"education","lineage":["https://openalex.org/I136806742"]}],"countries":["AZ"],"is_corresponding":false,"raw_author_name":"Vugar Abdullayev","raw_affiliation_strings":["Azerbaijan State Oil and Industry University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Azerbaijan State Oil and Industry University","institution_ids":["https://openalex.org/I136806742"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5056613300","display_name":"Alex Khang","orcid":"https://orcid.org/0000-0001-8379-4659","observed_orcids":["https://orcid.org/0000-0001-8379-4659"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Alex Khang","raw_affiliation_strings":["Global Research Institute of Technology and Engineering, Raleigh, United States"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Global Research Institute of Technology and Engineering, Raleigh, United States","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5130275411","display_name":"Nazila Ragimova","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I136806742","display_name":"Azerbaijan State Oil and Industry University","ror":"https://ror.org/05mmnns11","country_code":"AZ","type":"education","lineage":["https://openalex.org/I136806742"]}],"countries":["AZ"],"is_corresponding":false,"raw_author_name":"Nazila Ragimova","raw_affiliation_strings":["Azerbaijan State Oil and Industry University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Azerbaijan State Oil and Industry University","institution_ids":["https://openalex.org/I136806742"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"2027","issue":"1","first_page":"96","last_page":"96"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9872999787330627,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9872999787330627,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.0034000000450760126,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.0013000000035390258,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/explainable-ai","display_name":"explainable AI","score":0.890999972820282},{"id":"https://openalex.org/keywords/cyberattack-detection","display_name":"cyberattack detection","score":0.8420000076293945},{"id":"https://openalex.org/keywords/intrusion-detection","display_name":"intrusion detection","score":0.968999981880188},{"id":"https://openalex.org/keywords/real-time-network-traffic-analysis","display_name":"real-time network traffic analysis","score":0.7310000061988831},{"id":"https://openalex.org/keywords/cnn-bigru","display_name":"CNN-BiGRU","score":0.9179999828338623},{"id":"https://openalex.org/keywords/attention-mechanism","display_name":"attention mechanism","score":0.8190000057220459},{"id":"https://openalex.org/keywords/shap","display_name":"SHAP","score":0.9660000205039978},{"id":"https://openalex.org/keywords/lime","display_name":"lime","score":1.0},{"id":"https://openalex.org/keywords/post-hoc-explanation","display_name":"post-hoc explanation","score":0.8539999723434448},{"id":"https://openalex.org/keywords/risk-prediction-score","display_name":"risk scoring","score":0.777999997138977},{"id":"https://openalex.org/keywords/security-operations-center","display_name":"security operations center","score":0.8379999995231628},{"id":"https://openalex.org/keywords/cvss-scoring","display_name":"CVSS scoring","score":0.5049999952316284}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7494000196456909},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.7103000283241272},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.5491999983787537},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.5195000171661377},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4968999922275543},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.4505999982357025},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.43070000410079956},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.39469999074935913},{"id":"https://openalex.org/C12174686","wikidata":"https://www.wikidata.org/wiki/Q1058438","display_name":"Risk assessment","level":2,"score":0.3882000148296356},{"id":"https://openalex.org/C774472","wikidata":"https://www.wikidata.org/wiki/Q6760393","display_name":"Margin (machine learning)","level":2,"score":0.385699987411499},{"id":"https://openalex.org/C2780719617","wikidata":"https://www.wikidata.org/wiki/Q1030752","display_name":"Salient","level":2,"score":0.36890000104904175},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.32499998807907104},{"id":"https://openalex.org/C76178495","wikidata":"https://www.wikidata.org/wiki/Q4808784","display_name":"Asset (computer security)","level":2,"score":0.319599986076355},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.31529998779296875},{"id":"https://openalex.org/C2776359362","wikidata":"https://www.wikidata.org/wiki/Q2145286","display_name":"Representation (politics)","level":3,"score":0.3107999861240387},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.3100000023841858},{"id":"https://openalex.org/C64543145","wikidata":"https://www.wikidata.org/wiki/Q162942","display_name":"Intersection (aeronautics)","level":2,"score":0.295199990272522},{"id":"https://openalex.org/C82876162","wikidata":"https://www.wikidata.org/wiki/Q17096504","display_name":"Latency (audio)","level":2,"score":0.2849999964237213},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.2791999876499176}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.63180/jjic.thestap.2027.1.5","doi":"https://doi.org/10.63180/jjic.thestap.2027.1.5","is_oa":true,"landing_page_url":"https://doi.org/10.63180/jjic.thestap.2027.1.5","pdf_url":"https://thestap.blob.core.windows.net/jjic/articles/published/423441377342.pdf","source":{"id":"https://openalex.org/S5407049533","display_name":"Jordanian Journal of Informatics and Computing","issn_l":"3080-6828","issn":["3080-6828"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Jordanian Journal of Informatics and Computing","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.63180/jjic.thestap.2027.1.5","doi":"https://doi.org/10.63180/jjic.thestap.2027.1.5","is_oa":true,"landing_page_url":"https://doi.org/10.63180/jjic.thestap.2027.1.5","pdf_url":"https://thestap.blob.core.windows.net/jjic/articles/published/423441377342.pdf","source":{"id":"https://openalex.org/S5407049533","display_name":"Jordanian Journal of Informatics and Computing","issn_l":"3080-6828","issn":["3080-6828"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Jordanian Journal of Informatics and Computing","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7225411595.pdf","grobid_xml":"https://content.openalex.org/works/W7225411595.grobid-xml"},"referenced_works_count":23,"referenced_works":["https://openalex.org/W2064675550","https://openalex.org/W2099940443","https://openalex.org/W2148143831","https://openalex.org/W2157331557","https://openalex.org/W2296509296","https://openalex.org/W2342408547","https://openalex.org/W2516809705","https://openalex.org/W2618851150","https://openalex.org/W2756489700","https://openalex.org/W2789828921","https://openalex.org/W2861867928","https://openalex.org/W2902900716","https://openalex.org/W2915969651","https://openalex.org/W2926701059","https://openalex.org/W2981731882","https://openalex.org/W3017093935","https://openalex.org/W3032021129","https://openalex.org/W3093410479","https://openalex.org/W3121453273","https://openalex.org/W3161394766","https://openalex.org/W3204342889","https://openalex.org/W4294691140","https://openalex.org/W4313116287"],"related_works":["https://openalex.org/W7215753961","https://openalex.org/W7160768959","https://openalex.org/W7213322401","https://openalex.org/W7163357393","https://openalex.org/W7160265373","https://openalex.org/W7225320097","https://openalex.org/W7225377117","https://openalex.org/W7167472478","https://openalex.org/W7221333881","https://openalex.org/W7163392650"],"abstract_inverted_index":{"As":[0],"cyberattacks":[1],"become":[2],"more":[3,6],"sophisticated":[4],"and":[5,18,35,54,89,116,122,145,170,172,197,208,218,262,270,299,302,310],"common,":[7],"detection":[8,66,141,166,188,268],"systems":[9],"must":[10],"be":[11,29],"not":[12],"only":[13,274],"accurate":[14],"but":[15],"also":[16,280],"quick":[17],"easy":[19],"to":[20,28,52,128,148,228],"interpret.":[21],"Although":[22],"deep":[23,84],"learning":[24,85],"models":[25],"have":[26],"proven":[27],"very":[30],"effective":[31],"in":[32,44,59,245,265],"detecting":[33],"intrusion":[34,165],"malware,":[36],"their":[37,42],"black-box":[38],"nature":[39],"has":[40,233],"hindered":[41],"adoption":[43],"security":[45,248,288],"operations":[46,289],"centers":[47],"(SOCs),":[48],"where":[49],"analysts":[50],"need":[51],"explain":[53],"take":[55],"action":[56],"on":[57,162,212],"alerts":[58],"short":[60],"timeframes.":[61],"To":[62],"offer":[63],"real-time":[64,174,246],"cyberattack":[65],"with":[67,87,107,250,273,305],"quantitative":[68],"risk":[69,151,308],"assessment,":[70],"this":[71],"paper":[72],"presents":[73],"an":[74,108,193],"Explainable":[75],"AI":[76],"(XAI)":[77],"framework":[78,94,159,240,286],"that":[79,111,153,182,222,236],"integrates":[80,117],"a":[81,96,149,173,187,275,294,303],"lightweight":[82],"hybrid":[83,239],"detector":[86],"post-hoc":[88],"intrinsic":[90],"explainability":[91],"methods.":[92],"The":[93,158],"combines":[95],"Convolutional-Bidirectional":[97],"Gated":[98],"Recurrent":[99],"Unit":[100],"(CNN-BiGRU)":[101],"architecture":[102],"for":[103,132,243,287],"spatio-temporal":[104],"traffic":[105,175],"representation":[106],"attention":[109],"layer":[110],"highlights":[112],"salient":[113],"time":[114],"steps":[115],"SHAP":[118],"(Shapley":[119],"Additive":[120],"explanations)":[121],"LIME":[123],"(Local":[124],"Interpretable":[125],"Model-agnostic":[126],"Explanations)":[127],"generate":[129],"human-readable":[130],"justifications":[131],"every":[133],"prediction.":[134],"A":[135],"dynamic":[136,307],"risk-scoring":[137],"engine":[138],"then":[139],"translates":[140],"confidence,":[142],"feature-level":[143],"severity,":[144],"asset":[146],"criticality":[147],"normalized":[150],"index":[152,309],"enables":[154],"prioritized":[155],"incident":[156],"response.":[157],"is":[160,203,241],"tested":[161],"three":[163],"benchmark":[164],"datasets":[167],"(CICIDS2017,":[168],"NSL-KDD,":[169],"UNSW-NB15)":[171],"stream":[176],"generated":[177,225],"synthetically.":[178],"Experimental":[179],"results":[180],"reveal":[181],"the":[183,198,213,223,229,237,256,282,285,306],"proposed":[184,238],"model":[185],"achieves":[186,192],"accuracy":[189],"of":[190,195,201,216,267,284,293],"98.6%,":[191],"F1-score":[194],"0.981,":[196],"average":[199],"latency":[200],"inference":[202],"14.2":[204],"milliseconds":[205],"per":[206],"flow,":[207],"explanation":[209],"fidelity,":[210],"based":[211],"two":[214],"metrics":[215],"deletion/insertion":[217],"rank-correlation":[219],"stability,":[220],"demonstrates":[221,281],"explanations":[224],"are":[226],"faithful":[227],"model's":[230],"behavior.":[231],"It":[232,279],"been":[234],"shown":[235],"suitable":[242],"application":[244],"network":[247],"environments":[249],"limited":[251],"resources,":[252],"as":[253],"it":[254],"outperforms":[255],"standalone":[257],"CNN,":[258],"LSTM,":[259],"Random":[260],"Forest,":[261],"CNN-LSTM":[263],"baselines":[264],"terms":[266],"performance":[269],"retains":[271],"interpretability":[272],"minor":[276],"computational":[277],"cost.":[278],"applicability":[283],"workflows":[290],"by":[291],"means":[292],"comprehensive":[295],"ablation":[296],"study,":[297],"ROC":[298],"confusion-matrix":[300],"analysis,":[301],"comparison":[304],"static":[311],"CVSS-style":[312],"scoring.":[313]},"counts_by_year":[],"updated_date":"2026-11-08T12:12:28.789561","created_date":"2026-11-07T00:00:00"}