Cyber-Informed Machine Learning: End-User Value through Explainability
summary
Proposes a three-part explainability framework—data-to-human, model-to-human, human-to-model—and shows concrete methods: NetFlow needs cyber-aware feature transforms (partition by port then duration and bytes/packet), decision trees still match deep models on accuracy, and LIME can probe black-boxes. Demonstrates alert suppression via data poisoning needs roughly 15% poisoning of training data to stop alarms and recommends pairing a cyber analyst with a data scientist to build interpretable pipelines. Research gap: formal ways to elicit and encode analyst expertise.
AI-written summary · about
related talks
24mWhy and How to Build Explainability into your ML Workflow
01h 29mNavigating ML Explainability: From Theory to Implementation
29mTowards Explainable Machine Learning
17mChallenges Towards Production-Ready Explainable Machine Learning
45mExplainable Machine Learning Explained
46mExplaining a Machine Learning blackbox
32mAI/Machine Learning: What is Actually Working in Cybersecurity?
50mDehumanizing Agents: Why Explainability is Crucial in the LLM Era