{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,9]],"date-time":"2026-05-09T09:45:29Z","timestamp":1778319929500,"version":"3.51.4"},"reference-count":57,"publisher":"Frontiers Media SA","license":[{"start":{"date-parts":[[2024,5,13]],"date-time":"2024-05-13T00:00:00Z","timestamp":1715558400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["frontiersin.org"],"crossmark-restriction":true},"short-container-title":["Front. Comput. Sci."],"abstract":"<jats:p>Cyber attacking is easier than cyber defending\u2014attackers only need to find one breach, while the defenders must successfully repel all attacks. This research demonstrates how cyber defenders can increase their capabilities by joining forces with eXplainable-AI (XAI) utilizing interactive human-machine collaboration. With a global shortfall of cyber defenders there is a need to amplify their skills using AI. Cyber asymmetries make propositional machine learning techniques impractical. Human reasoning and skill is a key ingredient in defense and must be embedded in the AI framework. For Human-Machine collaboration to work requires that the AI is an ultra-strong machine learner and can explain its models. Unlike Deep Learning, Inductive Logic Programming can communicate what it learns to a human. An empirical study was undertaken using six months of eavesdropped network traffic from an organization generating up-to 562K network events daily. Easier-to-defend devices were identified using a form of the Good-Turing Frequency estimator which is a promising form of volatility measure. A behavioral cloning grammar in explicit symbolic form was then produced from a single device's network activity using the compression algorithm <jats:monospace>SEQUITUR<\/jats:monospace>. A novel visualization was generated to allow defenders to identify network sequences they wish to explain. Interactive Inductive Logic Programming (the XAI) is supplied the network traffic meta data, sophisticated pre-existing cyber security background knowledge, and one recurring sequence of events from a single device to explain. A co-inductive process between the human cyber defender and the XAI where the human is able to understand, then refute and shape the XAI's developing model, to produce a model that conforms with the data as well as the original device designers programming. The acceptable model is in a form that can be deployed as an ongoing active cyber defense.<\/jats:p>","DOI":"10.3389\/fcomp.2024.1321238","type":"journal-article","created":{"date-parts":[[2024,5,13]],"date-time":"2024-05-13T04:51:45Z","timestamp":1715575905000},"update-policy":"https:\/\/doi.org\/10.3389\/crossmark-policy","source":"Crossref","is-referenced-by-count":7,"title":["XAI Human-Machine collaboration applied to network security"],"prefix":"10.3389","volume":"6","author":[{"given":"Steve","family":"Moyle","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Andrew","family":"Martin","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Nicholas","family":"Allott","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1965","published-online":{"date-parts":[[2024,5,13]]},"reference":[{"key":"B1","doi-asserted-by":"publisher","first-page":"337","DOI":"10.1017\/S1471068418000285","article-title":"Constraint answer set programming without grounding","volume":"18","author":"Arias","year":"2018","journal-title":"Theory Pract Logic Progr"},{"key":"B2","author":"Axon","year":"2018","journal-title":"Sonification for network-security monitoring"},{"key":"B3","doi-asserted-by":"publisher","first-page":"125","DOI":"10.1093\/bjps\/47.1.125","article-title":"Novum organum","volume":"47","author":"Bacon","year":"1996","journal-title":"Br. J. Philos Sci"},{"key":"B4","article-title":"\u201cA framework for behavioural cloning,\u201d","author":"Bain","year":"1995","journal-title":"Machine Intelligence"},{"key":"B5","first-page":"2005","article-title":"Jevons and the logic \u2018piano'","volume":"1","author":"Barrett","year":"2005","journal-title":"Rutherford J"},{"key":"B6","doi-asserted-by":"publisher","DOI":"10.1145\/3581754.3584150","article-title":"\u201cInteractive model refinement in relational domains with inductive logic programming,\u201d","author":"Deane","year":"2023","journal-title":"Companion Proceedings of the 28th International Conference on Intelligent User Interfaces, pages"},{"key":"B7","doi-asserted-by":"publisher","first-page":"241","DOI":"10.1023\/A:1007460424845","article-title":"Pharmacophore discovery using the inductive logic programming system progol","volume":"30","author":"Finn","year":"1998","journal-title":"Mach. Learn"},{"key":"B8","doi-asserted-by":"crossref","DOI":"10.1017\/CBO9780511973000","volume-title":"Machine Learning: The Art and Science of Algorithms That Make Sense of Data","author":"Flach","year":"2012"},{"key":"B9","volume-title":"Data Mining: Practical Machine Learning Tools and Techniques","author":"Frank","year":"2016"},{"key":"B10","doi-asserted-by":"publisher","first-page":"217","DOI":"10.1080\/09296179508590051","article-title":"Good\u2013turing frequency estimation without tears","volume":"2","author":"Gale","year":"1995","journal-title":"J. Quant. Ling"},{"key":"B11","doi-asserted-by":"crossref","DOI":"10.1093\/oso\/9780198751588.001.0001","volume-title":"Artificial Intelligence and Scientific Method","author":"Gillies","year":"1996"},{"key":"B12","doi-asserted-by":"publisher","first-page":"237","DOI":"10.1093\/biomet\/40.3-4.237","article-title":"The population frequencies of species and the estimation of population parameters","volume":"40","author":"Good","year":"1953","journal-title":"Biometrika"},{"key":"B13","first-page":"41","article-title":"\u201cMitigating network-based attacks using mud-improving security of small-business and home iot devices,\u201d","author":"Grayeli","year":"2020","journal-title":"RSA Conference"},{"key":"B14","doi-asserted-by":"publisher","first-page":"e61","DOI":"10.1002\/ail2.61","article-title":"Darpa's explainable ai (xai) program: a retrospective","volume":"2","author":"Gunning","year":"2021","journal-title":"Appl. AI Lett"},{"key":"B15","unstructured":"Cybersecurity Workforce Study2022"},{"key":"B16","unstructured":"Common Criteria for Information Technology Security Evaluation. Common Criteria Project Sponsoring Organisations1999"},{"key":"B17","volume-title":"The Principles of Science: A Treatise on Logic and Scientific Method","author":"Jevons","year":"2012"},{"key":"B18","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1186\/s42400-019-0038-7","article-title":"Survey of intrusion detection systems: techniques, datasets and challenges","volume":"2","author":"Khraisat","year":"2019","journal-title":"Cybersecurity"},{"key":"B19","doi-asserted-by":"publisher","first-page":"438","DOI":"10.1073\/pnas.93.1.438","article-title":"Structure-activity relationships derived by machine learning: the use of atoms and their bond connectivities to predict mutagenicity by inductive logic programming","volume":"93","author":"King","year":"1996","journal-title":"Proc. Natl. Acad. Sci. USA"},{"key":"B20","doi-asserted-by":"crossref","first-page":"142","DOI":"10.1109\/SECPRI.2000.848452","article-title":"\u201cLogic induction of valid behavior specifications for intrusion detection,\u201d","author":"Ko","year":"2000","journal-title":"2000 IEEE Symposium on Security and Privacy, Berkeley, California, USA, May 14-17, 2000"},{"key":"B21","unstructured":"\u201cW3C semantic web activity,\u201d\n            KoivunenM.-R.\n            MillerE.\n          27481023Proceedings of the Semantic Web Kick-off Seminar in Finland2001"},{"key":"B22","doi-asserted-by":"crossref","DOI":"10.1017\/CBO9780511984747","volume-title":"Computational Logic and Human Thinking: How to Be Artificially Intelligent","author":"Kowalski","year":"2011"},{"key":"B23","unstructured":"LifschitzV.\n          What Is Answer Set Programming2022"},{"key":"B24","doi-asserted-by":"crossref","DOI":"10.1007\/978-3-642-96826-6","volume-title":"Foundations of Logic Programming","author":"Lloyd","year":"1984"},{"key":"B25","unstructured":"Distributed Device Descriptors (D3)2021"},{"key":"B26","first-page":"75","article-title":"\u201cPrograms with common sense,\u201d","volume-title":"Proceedings of the Teddington Conference on the Mechanization of Thought Processes","author":"McCarthy","year":"1959"},{"key":"B27","article-title":"\u201cWhat got us here wont get us there,\u201d","author":"Meer","year":"2015","journal-title":"Black-Hat Europe"},{"key":"B28","author":"Megas","year":"2022","journal-title":"Profile of the iot core baseline for consumer iot products"},{"key":"B29","first-page":"107","article-title":"\u201cMachine learning in the next five years,\u201d","volume-title":"Third European Workshop Session on Learning (EWSL '88)","author":"Michie","year":"1988"},{"key":"B30","article-title":"\u201cModelling cyber defenses using s(casp),\u201d","author":"Moyle","year":"","journal-title":"Proceedings of the International Conference on Logic Programming 2023 Workshops co-located with the 39th International Conference on Logic Programming (ICLP 2023), London, United Kingdom, July 9th and 10th, 2023, volume 3437 of CEUR Workshop Proceedings. CEUR-WS.org"},{"key":"B31","doi-asserted-by":"crossref","first-page":"371","DOI":"10.1007\/978-3-540-45224-9_52","article-title":"\u201cMachine learning to detect intrusion strategies,\u201d","volume-title":"Knowledge-Based Intelligent Information and Engineering Systems","author":"Moyle","year":"2003"},{"key":"B32","unstructured":"MoyleS.\n            MartinA.\n            AllottN.\n          Identifying iot-like devices and using collaborative xai to understand their cyber security behaviour"},{"key":"B33","doi-asserted-by":"publisher","first-page":"3","DOI":"10.3233\/AIC-130579","article-title":"Alan turing and the development of artificial intelligence","volume":"27","author":"Muggleton","year":"2014","journal-title":"AI Commun"},{"key":"B34","doi-asserted-by":"publisher","first-page":"629","DOI":"10.1016\/0743-1066(94)90035-3","article-title":"Inductive logic programming: theory and methods","volume":"19","author":"Muggleton","year":"1994","journal-title":"J. Logic Progr"},{"key":"B35","doi-asserted-by":"publisher","first-page":"1119","DOI":"10.1007\/s10994-018-5707-3","article-title":"Ultra-strong machine learning: comprehensibility of programs learned with ilp","volume":"107","author":"Muggleton","year":"2018","journal-title":"Mach. Learn"},{"key":"B36","doi-asserted-by":"crossref","first-page":"3","DOI":"10.1109\/DCC.1997.581951","article-title":"\u201cLinear-time, incremental hierarchy inference for compression,\u201d","author":"Neville-Manning","year":"1997","journal-title":"Data Compression Conference (DCC '97)"},{"key":"B37","doi-asserted-by":"publisher","first-page":"2838","DOI":"10.1109\/TVCG.2018.2859969","article-title":"Understanding user behaviour through action sequences: from the usual to the unusual","volume":"25","author":"Nguyen","year":"2018","journal-title":"IEEE Trans Visual. Comput. Graph"},{"key":"B38","year":"2021","journal-title":"Four principles of explainable artificial intelligence"},{"key":"B39","unstructured":"OpenVAS - Open Vulnerability Assessment Scanner2023"},{"key":"B40","author":"Peirce","year":"1996","journal-title":"Elements of logic"},{"key":"B41","volume-title":"The Logic of Scientific Discovery","author":"Popper","year":"1935"},{"key":"B42","first-page":"54","article-title":"\u201cUsing ilp to analyse ransomware attacks,\u201d","author":"Ray","year":"2016","journal-title":"26th International Conference on Inductive Logic Programming (ILP), CEUR 1865"},{"key":"B43","doi-asserted-by":"publisher","DOI":"10.1109\/KSE53942.2021.9648769","article-title":"\u201cTowards expert-guided elucidation of cyber attacks through interactive inductive logic programming,\u201d","author":"Ray","year":"2021","journal-title":"13th International Conference on Knowledge and Systems Engineering (KSE)"},{"key":"B44","doi-asserted-by":"publisher","first-page":"23","DOI":"10.1145\/321250.321253","article-title":"A machine-oriented logic based on the resolution principle","volume":"12","author":"Robinson","year":"1965","journal-title":"J. ACM"},{"key":"B45","article-title":"\u201c(re)integration of logical english and s(casp),\u201d","author":"Sartor","year":"2023","journal-title":"Proceedings of the International Conference on Logic Programming 2023 Workshops co-located with the 39th International Conference on Logic Programming (ICLP 2023), London, United Kingdom, July 9th and 10th, 2023, volume 3437 of CEUR Workshop Proceedings. CEUR-WS.org"},{"key":"B46","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2020\/773","article-title":"\u201cLossless semantic round-tripping in peng asp,\u201d","author":"Schwitter","year":"2020","journal-title":"Proceedings of the Twenty-Ninth International Joint Conference on Artificial Intelligence, IJCAI-20"},{"key":"B47","unstructured":"SrinivasanA.\n          The Aleph Manual2001"},{"key":"B48","article-title":"One-way explainability isn't the message","author":"Srinivasan","year":"2022","journal-title":"arXiv preprint arXiv:2205.08954"},{"key":"B49","doi-asserted-by":"publisher","first-page":"761","DOI":"10.1145\/358198.358210","article-title":"Reflections on trusting trust","volume":"27","author":"Thompson","year":"1984","journal-title":"Commun. ACM"},{"key":"B50","doi-asserted-by":"publisher","first-page":"230","DOI":"10.1112\/plms\/s2-42.1.230","article-title":"On computable numbers, with an application to the entscheidungsproblem","volume":"42","author":"Turing","year":"1937","journal-title":"Proc. London Mathem. Soc"},{"key":"B51","doi-asserted-by":"publisher","first-page":"433","DOI":"10.1093\/mind\/LIX.236.433","article-title":"Computing machinery and intelligence","volume":"59","author":"Turing","year":"1950","journal-title":"Mind"},{"key":"B52","unstructured":"1D Number Array Clustering. Stackexchange question answered Jul 6 '21 at 13:02 by tyrex2021"},{"key":"B53","doi-asserted-by":"publisher","year":"1985","journal-title":"Department of Defense, Trusted Computer System Evaluation Criteria","DOI":"10.1007\/978-1-349-12020-8_1"},{"key":"B54","article-title":"\u201cAn architecture for making object-oriented systems available from prolog,\u201d","author":"Wielemaker","year":"2002","journal-title":"Workshop on Logic Programming Environments"},{"key":"B55","doi-asserted-by":"publisher","first-page":"67","DOI":"10.1017\/S1471068411000494","article-title":"Swi-prolog","volume":"12","author":"Wielemaker","year":"2010","journal-title":"Theory Pract Logic Progr"},{"key":"B56","volume-title":"What Is ChatGPT Doing \u2026 and Why Does It Work","author":"Wolfram","year":"2023"},{"key":"B57","unstructured":"36298351The Zeek Network Security Monitor2021"}],"container-title":["Frontiers in Computer Science"],"original-title":[],"link":[{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/fcomp.2024.1321238\/full","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,5,13]],"date-time":"2024-05-13T04:51:58Z","timestamp":1715575918000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/fcomp.2024.1321238\/full"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,5,13]]},"references-count":57,"alternative-id":["10.3389\/fcomp.2024.1321238"],"URL":"https:\/\/doi.org\/10.3389\/fcomp.2024.1321238","relation":{},"ISSN":["2624-9898"],"issn-type":[{"value":"2624-9898","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,5,13]]},"article-number":"1321238"}}