XAI-CF -- Examining the Role of Explainable Artificial Intelligence in Cyber Forensics
Department of Information Security, College of Computer Science and Engineering, University of Ha’il, Ha’il, Saudi Arabia（信息安全系，计算机科学与工程学院，哈伊尔大学，沙特阿拉伯）
Shahid Alam, Zeynep Altiparmak
发表信息：
Engineering Applications of Artificial Intelligence, 167(3), 2026, 113892
With the rise of complex cyber devices Cyber Forensics (CF) is facing many new challenges. For example, there are dozens of systems running on smartphones, each with more than millions of downloadable applications. Sifting through this large amount of data and making sense requires new techniques, such as from the field of Artificial Intelligence (AI). To apply these techniques successfully in CF, we need to justify and explain the results to the stakeholders of CF, such as forensic analysts and members of the court, for them to make an informed decision. If we want to apply AI successfully in CF, there is a need to develop trust in AI systems. Some other factors in accepting the use of AI in CF are to make AI authentic, interpretable, understandable, and interactive. This way, AI systems will be more acceptable to the public and ensure alignment with legal standards. An explainable AI (XAI) system can play this role in CF, and we call such a system XAI-CF. XAI-CF is indispensable and is still in its infancy. In this paper, we explore and make a case for the significance and advantages of XAI-CF. We strongly emphasize the need to build a successful and practical XAI-CF system and discuss some of the main requirements and prerequisites of such a system. We present a formal definition of the terms CF and XAI-CF and a comprehensive literature review of previous works that apply and utilize XAI to build and increase trust in CF. We discuss some challenges facing XAI-CF. We also provide some concrete solutions to these challenges. We identify key insights and future research directions for building XAI applications for CF. This paper is an effort to explore and familiarize the readers with the role of XAI applications in CF, and we believe that our work provides a promising basis for future researchers interested in XAI-CF.
Brandon University（布兰登大学）；Pandit Deendayal Energy University（潘迪特·丁达亚尔能源大学）；Vellore Institute of Technology（韦洛尔理工学院）；Symbiosis International Deemed University（共生国际被视为大学）；The Open University（开放大学）
In the past few years, artificial intelligence (AI) techniques have been implemented in almost all verticals of human life. However, the results generated from the AI models often lag explainability. AI models often appear as a blackbox wherein developers are unable to explain or trace back the reasoning behind a specific decision. Explainable AI (XAI) is a rapid growing field of research which helps to extract information and also visualize the results generated with an optimum transparency. The present study provides and extensive review of the use of XAI in cybersecurity. Cybersecurity enab…
Cybersecurity vendors consistently apply AI (Artificial Intelligence) to their solutions and many cybersecurity domains can benefit from AI technology. However, black-box AI techniques present some difficulties in comprehension and adoption by its operators, given that their decisions are not always humanly understandable (as is usually the case with deep neural networks, for example). Since it aims to make the operation of AI algorithms more interpretable for its users and developers, XAI (eXplainable Artificial Intelligence) can be used to address this issue. Through a systematic literature …
A Survey on Explainable Artificial Intelligence for Cybersecurity
Princess Sumaya University for Technology（苏玛雅公主科技大学）；Concordia University（康考迪亚大学）；Polytechnique Montréal（蒙特利尔理工学院）；Khalifa University（哈利法大学）；University of Waterloo（滑铁卢大学）；Lebanese American University（黎巴嫩美国大学）；New York University（纽约大学）
LENS-XAI: Redefining Lightweight and Explainable Network Security through Knowledge Distillation and Variational Autoencoders for Scalable Intrusion Detection in Cybersecurity
Kırıkkale University（克尔克卡拉大学）；University College Dublin（都柏林大学学院）；CeADAR；School of Computer Science（计算机科学学院）
Explainable AI-based Intrusion Detection System for Industry 5.0: An Overview of the Literature, associated Challenges, the existing Solutions, and Potential Research Directions
Hamad bin Khalifa University（哈马德·本·哈利法大学）；Qatar Computing Research Institute（卡塔尔计算研究所）；Munster Technological University（芒斯特理工大学）；Toronto Metropolitan University（多伦多都会大学）
With the widespread integration of AI in everyday and critical technologies, it seems inevitable to witness increasing instances of failure in AI systems. In such cases, there arises a need for technical investigations that produce legally acceptable and scientifically indisputable findings and conclusions on the causes of such failures. Inspired by the domain of cyber forensics, this paper introduces the need for the establishment of AI Forensics as a new discipline under AI safety. Furthermore, we propose a taxonomy of the subfields under this discipline, and present a discussion on the foun…
Arizona State University（亚利桑那州立大学）；Institute for Computer Science and Engineering (ICIC UNS–CONICET)（计算机科学与工程研究所（ICIC UNS–CONICET））；Institute for Computer Science Research (ICC UBA–CONICET)（计算机科学研究所（ICC UBA–CONICET））；Universidad Nacional del Sur（南方国立大学）；Universidad Nacional de Entre Ríos（恩特雷里奥斯国立大学）；Universidad de Buenos Aires（布宜诺斯艾利斯大学）
With the availability of large datasets and ever-increasing computing power, there has been a growing use of data-driven artificial intelligence systems, which have shown their potential for successful application in diverse areas. However, many of these systems are not able to provide information about the rationale behind their decisions to their users. Lack of understanding of such decisions can be a major drawback, especially in critical domains such as those related to cybersecurity. In light of this problem, in this paper we make three contributions: (i) proposal and discussion of deside…
Washington University（华盛顿大学）；Qatar University（卡塔尔大学）
Despite AI's significant growth, its "black box" nature creates challenges in generating adequate trust. Thus, it is seldom utilized as a standalone unit in IoT high-risk applications, such as critical industrial infrastructures, medical systems, and financial applications, etc. Explainable AI (XAI) has emerged to help with this problem. However, designing appropriately fast and accurate XAI is still challenging, especially in numerical applications. Here, we propose a universal XAI model named Transparency Relying Upon Statistical Theory (TRUST), which is model-agnostic, high-performing, and …
University of Missouri（密苏里大学）；Kennesaw State University（肯尼索州立大学）；University of Texas at San Antonio（德克萨斯大学圣安东尼奥分校）
Cybersickness is a common ailment associated with virtual reality (VR) user experiences. Several automated methods exist based on machine learning (ML) and deep learning (DL) to detect cybersickness. However, most of these cybersickness detection methods are perceived as computationally intensive and black-box methods. Thus, those techniques are neither trustworthy nor practical for deploying on standalone energy-constrained VR head-mounted devices (HMDs). In this work, we present an explainable artificial intelligence (XAI)-based framework, LiteVR, for cybersickness detection, explaining the …
A plethora of recent research has proposed several automated methods based on machine learning (ML) and deep learning (DL) to detect cybersickness in Virtual reality (VR). However, these detection methods are perceived as computationally intensive and black-box methods. Thus, those techniques are neither trustworthy nor practical for deploying on standalone VR head-mounted displays (HMDs). This work presents an explainable artificial intelligence (XAI)-based framework VR-LENS for developing cybersickness detection ML models, explaining them, reducing their size, and deploying them in a Qualcom…
University of Houston（休斯顿大学）；University of Greenwich（格林威治大学）；Pennsylvania State University（宾夕法尼亚州立大学）
In the wake of a cybersecurity incident, it is crucial to promptly discover how the threat actors breached security in order to assess the impact of the incident and to develop and deploy countermeasures that can protect against further attacks. To this end, defenders can launch a cyber-forensic investigation, which discovers the techniques that the threat actors used in the incident. A fundamental challenge in such an investigation is prioritizing the investigation of particular techniques since the investigation of each technique requires time and effort, but forensic analysts cannot know wh…
The number of cyber attacks has increased tremendously in the last few years. This resulted into both human and financial losses at the individual and organization levels. Recently, cyber-criminals are leveraging new skills and capabilities by employing anti-forensics activities, techniques and tools to cover their tracks and evade any possible detection. Consequently, cyber-attacks are becoming more efficient and more sophisticated. Therefore, traditional cryptographic and non-cryptographic solutions and access control systems are no longer enough to prevent such cyber attacks, especially in …
Exploring Energy Landscapes for Minimal Counterfactual Explanations: Applications in Cybersecurity and Beyond
Netcompany-Intrasoft S.A.（Netcompany-Intrasoft公司）；Hellenic Mediterranean University（希腊地中海大学）；Harokopio University of Athens（雅典哈罗科皮奥大学）；University of Western Macedonia（西马其顿大学）
Explainable AI-Driven Cyber Risk Analytics and Model Reliability Assessment for Intelligent Governance of U.S. Critical Infrastructure: An XGBoost and SHAP-Based Intrusion Detection Framework
Department of Business Information Systems, Central Michigan University（中央密歇根大学商业信息系统系）；Department of Information Studies, Trine University（特林大学信息学系）；Department of Computer Science, Maharishi International University（Maharishi国际大学计算机科学系）
Cyber-attacks are increasing and varying dramatically day by day. It has become challenging to control cyber-attacks and to identify the perpetrators and their intentions. In general, the analysis of the intentions of cyber-attacks is one of the main challenges in digital forensics. In many cases of cyber-attacks, the analysis of the intent of the attacks determines the strategy and tools used in the attack, thus facilitating the process of identifying the perpetrator of the attack with greater accuracy. In this paper a model will be proposed to analyze the intentions of cyber-attacks. In this…
The explosion in the e-commerce industry which has been necessitated by the growth and advance expansion of Information technology and its related facilities in recent years have been met with adverse security issues consequently affecting the industry and the entire online activities. This paper exams the prevailing security threats e-commerce is facing which is predominantly known as cyber-crime and how computer related technology and facilities such as digital forensics tools can be adopted extensively to ensure security in online related business activities. This paper investigated the ris…
The frequency and harmfulness of cyber-attacks are increasing every day, and with them also the amount of data that the cyber-forensics analysts need to collect and analyze. In this paper, we propose a formal analysis process that allows an analyst to filter the enormous amount of evidence collected and either identify crucial information about the attack (e.g., when it occurred, its culprit, its target) or, at the very least, perform a pre-analysis to reduce the complexity of the problem in order to then draw conclusions more swiftly and efficiently. We introduce the Evidence Logic EL for rep…
Conversational versus Dashboard Explainable AI for UAV Intrusion Detection: An Empirical Study of Operator Trust and Reliance
Phenikaa University（菲卡大学）；Phenikaa School of Computing（菲卡计算机学院）；MobiFone Corporation（MobiFone集团）；MobiFone HighTech Center（MobiFone高科技中心）；National Economics University（国民经济大学）；College of Technology（技术学院）
Forensic Schema for Psychological Manipulation in Cyber Fraud: LLM-Driven Victim Reports Analysis
School of Engineering and Technology University of Washington（华盛顿大学塔科马分校工程学院与技术学院）；Department of Computer Science North Dakota State University（北达科他州立大学计算机科学系）
Human in the AI loop via xAI and Active Learning for Visual Inspection
Jožef Stefan Institute（约瑟夫·斯特凡研究所）；Qlector d.o.o.（Qlector公司）；University of Applied Sciences and Arts of Southern Switzerland（瑞士南部应用科学与艺术大学）；Ubitech Ltd.（Ubitech有限公司）；University of Ljubljana（卢布尔雅那大学）；University of West Attica（西阿提卡大学）；University of Groningen（格罗宁根大学）
本文提出结合主动学习与可解释人工智能，将人类纳入视觉检测的 AI 回路，并综述工业 5.0 人机协作及 STAR 项目相关成果。
The synthesis of technology and the medical industry has partly contributed to the increasing interest in Medical Cyber-Physical Systems (MCPS). While these systems provide benefits to patients and professionals, they also introduce new attack vectors for malicious actors (e.g. financially-and/or criminally-motivated actors). A successful breach involving a MCPS can impact patient data and system availability. The complexity and operating requirements of a MCPS complicates digital investigations. Coupling this information with the potentially vast amounts of information that a MCPS produces an…
Exploring the Potential of Large Language Models for Improving Digital Forensic Investigation Efficiency
Security Research Group, School of Computer Science , addressline= University College Dublin , city= Belfield , state= Dublin 4 , country= Ireland；organization= School of Criminal Justice , addressline= University of Lausanne , state= Lausanne , country= Switzerland；organization= Present affiliation: Institute of Computer Science , addressline= University of Augsburg , state= Augsburg , country= Germany
Mobile devices are increasingly utilized to access social media and instant messaging services, which allow users to communicate with others easily and quickly. However, the misuse of social media and instant messaging services facilitated conducting different cybercrimes such as cyber stalking, cyber bullying, slander spreading and sexual harassment. Therefore, mobile devices are an important evidentiary piece in digital investigation. In this chapter, we report the results of our investigation and analysis of social media and instant messaging services in Firefox OS. We examined three social…
This survey presents a comprehensive review of current literature on Explainable Artificial Intelligence (XAI) methods for cyber security applications. Due to the rapid development of Internet-connected systems and Artificial Intelligence in recent years, Artificial Intelligence including Machine Learning (ML) and Deep Learning (DL) has been widely utilized in the fields of cyber security including intrusion detection, malware detection, and spam filtering. However, although Artificial Intelligence-based approaches for the detection and defense of cyber attacks and threats are more advanced an…
G.H.Raisoni College of Engineering（G.H.拉伊索尼工程学院）；MPGI
Authorship Identification techniques are used to identify the most appropriate author from group of potential suspects of online messages and find evidences to support the conclusion. Cybercriminals make misuse of online communication for sending blackmail or a spam email and then attempt to hide their true identities to void detection.Authorship Identification of online messages is the contemporary research issue for identity tracing in cyber forensics. This is highly interdisciplinary area as it takes advantage of machine learning, information retrieval, and natural language processing. In t…
National Research Council of Italy (CNR)（意大利国家研究委员会）；Institute of Electronics and Information and Telecommunications Engineering (IEIIT)（电子、信息与电信工程研究所）；Università degli studi di Genova（热那亚大学）；Politecnico di Torino（都灵理工大学）
Network forensic techniques help in tracking different types of cyber attack by monitoring and inspecting network traffic. However, with the high speed and large sizes of current networks, and the sophisticated philosophy of attackers, in particular mimicking normal behaviour and/or erasing traces to avoid detection, investigating such crimes demands intelligent network forensic techniques. This paper suggests a real-time collaborative network Forensic scheme (RCNF) that can monitor and investigate cyber intrusions. The scheme includes three components of capturing and storing network data, se…
Due to its critical role in cybersecurity, digital forensics has received significant attention from researchers and practitioners alike. The ever increasing sophistication of modern cyberattacks is directly related to the complexity of evidence acquisition, which often requires the use of several technologies. To date, researchers have presented many surveys and reviews on the field. However, such articles focused on the advances of each particular domain of digital forensics individually. Therefore, while each of these surveys facilitates researchers and practitioners to keep up with the lat…
In today's world of computers, any kind of information can be made available within few clicks for different endeavors. The information may be tampered by changing the statistical properties and can be further used for criminal activities. These days, Cyber crimes are happening at a very large scale, and possess big threats to the security of an individual, firm, industry and even to developed countries. To combat such crimes, law enforcement agencies and investment institutions are incorporating supportive examination policies, procedures and protocols to address the complete investigation pr…
Research in the field of network forensics is gradually expanding with the propensity to fully accommodate the tenacity to help in adjudicating, curbing and apprehending the exponential growth of cyber crimes. However, investigating cyber crime differs, depending on the perspective of investigation. There is therefore the need for a comprehensive model, containing relevant critical features required for a thorough investigation for each perspective, which can be adopted by investigators. This paper therefore presents the findings on the critical features for each perspective, as well as their …
The increasing adoption of Internet-of-Things (IoT) devices present new challenges to digital forensic investigators and law enforcement agencies when investigation into cybercrime on these new platforms are required. However, there has been no formal study to document actual challenges faced by investigators and whether existing tools help them in their work. Prior issues such as the correlation and consistency problem in digital forensic evidence have also become a pressing concern in light of numerous evidence sources from IoT devices. Motivated by these observations, we conduct a user stud…
Cryptocurrencies have emerged as a new form of digital money that has not escaped the eyes of cyber-attackers. Traditionally, they have been maliciously used as a medium of exchange for proceeds of crime in the cyber dark-market by cyber-criminals. However, cyber-criminals have devised an exploitative technique of directly acquiring cryptocurrencies from benign users' CPUs without their knowledge through a process called crypto mining. The presence of crypto mining activities in a network is often an indicator of compromise of illegal usage of network resources for crypto mining purposes. Cryp…
Cloud computing is a web-based utility model that is becoming popular every day with the emergence of 4th Industrial Revolution, therefore, cybercrimes that affect web-based systems are also relevant to cloud computing. In order to conduct a forensic investigation into a cyber-attack, it is necessary to identify and locate the source of the attack as soon as possible. Although significant study has been done in this domain on obstacles and its solutions, research on approaches and strategies is still in its development stage. There are barriers at every stage of cloud forensics, therefore, bef…
Delft University of Technology（代尔夫特理工大学）；University of Padua（帕多瓦大学）
Explainable Artificial Intelligence (XAI) aims to improve the transparency of machine learning (ML) pipelines. We systematize the increasingly growing (but fragmented) microcosm of studies that develop and utilize XAI methods for defensive and offensive cybersecurity tasks. We identify 3 cybersecurity stakeholders, i.e., model users, designers, and adversaries, who utilize XAI for 4 distinct objectives within an ML pipeline, namely 1) XAI-enabled user assistance, 2) XAI-enabled model verification, 3) explanation verification & robustness, and 4) offensive use of explanations. Our analysis of t…
This paper further introduces and formalizes a novel concept of self-forensics for automotive vehicles, specified in the Forensic Lucid language. We argue that self-forensics, with the forensics taken out of the cybercrime domain, is applicable to "self-dissection" of intelligent vehicles and hardware systems for automated incident and anomaly analysis and event reconstruction by the software with or without the aid of the engineering teams in a variety of forensic scenarios. We propose a formal design, requirements, and specification of the self-forensic enabled units (similar to blackboxes) …
