arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2503.02065cs.CRcs.AIcs.IR
收藏

信任过度?衡量AI驱动安全运营中心中可解释性的安全与认知影响

Too Much to Trust? Measuring the Security and Cognitive Impacts of Explainability in AI-Driven SOCs

Rochester Institute of Technology(罗切斯特技术学院);Independent Researcher(独立研究者)

Nidhi Rastogi, Shirid Pant, Devang Dhanuka, Amulya Saxena, Pranjal Mairal

AI总结:

本文通过混合方法研究SOC分析师对XAI解释的认知,发现角色感知且上下文丰富的可解释性设计能提升理解、分诊效率与响应信心,即便预测准确率较低也能被接受。

摘要:

可解释人工智能(XAI)在增强安全运营中心(SOCs)中AI驱动威胁检测的透明度和可信度方面具有显著前景。然而,如何确定适当的解释层级与形式,尤其是在需要在高风险条件下快速决策的环境中,仍然是一个复杂且未被充分探索的挑战。为填补这一空白,我们开展了一项为期三个月的混合方法研究,结合在线调查(N1=248)与深度访谈(N2=24),以考察(1)SOC分析师如何概念化AI生成的解释,以及(2)在不同分析师角色中,哪些类型的解释被认为具有可操作性和可信度。我们的研究结果表明,当解释被认为具有相关性且有证据支持时,参与者始终愿意接受XAI输出,即使在预测准确率较低的情况下也是如此。分析师们反复强调理解AI决策背后理由的重要性,并表现出对上下文深度的强烈偏好,而非仅仅在仪表板上呈现结果。基于这些见解,本研究重新评估了当前安全情境下的解释方法,并证明与SOC工作流相一致的、具备角色感知和丰富上下文的XAI设计能够显著提升实际效用。这种量身定制的可解释性增强了分析师的理解能力,提高了分诊效率,并支持对不断演变的威胁做出更有信心的响应。

英文摘要:

Explainable AI (XAI) holds significant promise for enhancing the transparency and trustworthiness of AI-driven threat detection in Security Operations Centers (SOCs). However, identifying the appropriate level and format of explanation, particularly in environments that demand rapid decision-making under high-stakes conditions, remains a complex and underexplored challenge. To address this gap, we conducted a three-month mixed-methods study combining an online survey (N1=248) with in-depth interviews (N2=24) to examine (1) how SOC analysts conceptualize AI-generated explanations and (2) which types of explanations are perceived as actionable and trustworthy across different analyst roles. Our findings reveal that participants were consistently willing to accept XAI outputs, even in cases of lower predictive accuracy, when explanations were perceived as relevant and evidence-backed. Analysts repeatedly emphasized the importance of understanding the rationale behind AI decisions, expressing a strong preference for contextual depth over a mere presentation of outcomes on dashboards. Building on these insights, this study re-evaluates current explanation methods within security contexts and demonstrates that role-aware, context-rich XAI designs aligned with SOC workflows can substantially improve practical utility. Such tailored explainability enhances analyst comprehension, increases triage efficiency, and supports more confident responses to evolving threats.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑