Scholarlink

<p>Cybersecurity incident response (CSIR) is paramount for organizational resilience. At its core, analysts undertake a cognitively demanding process of data analytics to correlate data points, identify patterns, and synthesize diverse information. Recently, artificial intelligence (AI) based solutions have been utilized to streamline CSIR workflows, notably with an increasing focus on explainable AI (XAI) to ensure transparency. However, XAI also poses challenges, requiring analysts to allocate additional time to process explanations. This study addresses the gap in understanding how AI and its explanations can be seamlessly integrated into CSIR workflows. Employing a multi-method approach, we first interviewed analysts to identify their cognitive challenges, interactions with AI, and expectations from XAI. In a subsequent case study, we investigated the evolution of analysts' needs for AI explanations throughout the investigative process. Our findings yield several key propositions for addressing the cognitive impacts of XAI in CSIR, aiming to enhance cognitive fit to reduce analysts' cognitive load during investigations.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Cognitive Impacts of Explainable AI in Cybersecurity Incident Response: Challenges and Propositions

  • 期刊论文

  • 发表日期：

    2025年5月13日

查看全文
  • Chen Zhong,
  • Alper Yayla

摘要

Cybersecurity incident response (CSIR) is paramount for organizational resilience. At its core, analysts undertake a cognitively demanding process of data analytics to correlate data points, identify patterns, and synthesize diverse information. Recently, artificial intelligence (AI) based solutions have been utilized to streamline CSIR workflows, notably with an increasing focus on explainable AI (XAI) to ensure transparency. However, XAI also poses challenges, requiring analysts to allocate additional time to process explanations. This study addresses the gap in understanding how AI and its explanations can be seamlessly integrated into CSIR workflows. Employing a multi-method approach, we first interviewed analysts to identify their cognitive challenges, interactions with AI, and expectations from XAI. In a subsequent case study, we investigated the evolution of analysts' needs for AI explanations throughout the investigative process. Our findings yield several key propositions for addressing the cognitive impacts of XAI in CSIR, aiming to enhance cognitive fit to reduce analysts' cognitive load during investigations.