AnomalyExplainer Explainable AI for LLM-based anomaly detection using BERTViz and Captum

Dumindu Kankanamge; Ekaterina Gilman; Mourad Oussalah; Prasasthy Balasubramanian

REVIEW 5 major objections 5 minor 1 cited by

AnomalyExplainer Explainable AI for LLM-based anomaly detection using BERTViz and Captum

T0 review · 5 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A log-analysis chatbot detects anomalies with RoBERTa and explains its decisions through attention visualizations and natural-language reports.

desk verdict A functional chat-based log anomaly detector with honest reporting, but the 'high-quality explanations' claim rests on an unvalidated attention-summary heuristic and a user study that mostly shows the chatbot is usable, not that explanations build trust. read the letter →

arxiv 2509.00069 v1 pith:BNDFUENB submitted 2025-08-26 cs.LG

Prasasthy Balasubramanian , Dumindu Kankanamge , Ekaterina Gilman , Mourad Oussalah This is my paper

classification cs.LG

keywords explainableAIloganomalydetectionattentionvisualizationBERTVizCaptumRoBERTaconversationalagentcybersecurity

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes AnomalyExplainerBot, a conversational framework for cybersecurity log analysis. It fine-tunes RoBERTa to label each log line as normal or anomalous, then uses BERTViz and Captum to turn the model's attention patterns into visual explanations and a natural-language report. The authors compare four transformer models on the HDFS dataset and report RoBERTa at 99.6% accuracy, with Mistral-7B scoring perfectly but too heavy for efficient integration, Falcon failing to catch anomalies, and DeBERTa weaker on anomaly recall. A 13-person user study finds the chatbot interface easy to use and the text explanations helpful, while the visualization tab was often unused or timed out. The intended payoff is that a security analyst can trust and act on AI anomaly flags faster, with less manual triage.

What carries the argument

The load-bearing mechanism is Algorithm 1, a unified attention-analysis routine. It averages per-token attention over all heads and layers, normalizes the scores, keeps the top-k tokens, ranks heads by the entropy of their attention distributions (lowest entropy = most focused), ranks layers by averaged inverse entropy, and flags special-token bias. These outputs feed a structured textual report; BERTViz renders the attention graphs and Captum supplies feature attribution. The algorithm is what converts raw transformer attention into something an analyst can read.

What would settle it

Compare attention-based explanations on logs where RoBERTa is correct and logs where it is wrong: if the generated reports are equally plausible for both, the explanations are not tracking the model's true decision process. Alternatively, perturb or remove the top-ranked attention tokens and check whether predictions change as the report implies; if they do not, the explanation claim fails.

Watch

Extended reading notes

Core claim

The central claim is that attention-based, after-the-fact explainability can be packaged into a conversational security workflow without sacrificing detection quality. On the paper's test split, fine-tuned RoBERTa reaches 99.6% accuracy, 1.00 precision on both classes, and 0.91 anomaly recall, outperforming Falcon-7B and DeBERTa and offering a lighter alternative to Mistral-7B (Yarn), which scores perfectly but is too large for efficient integration. Explanations are generated by averaging attention across heads and layers, ranking tokens by attention mass, selecting low-entropy 'focused' heads and high-focus layers, and checking for special-token bias (Algorithm 1), then rendered as BERTViz

Load-bearing premise

The framework assumes the attention summaries and attribution views it presents actually explain why the model flagged a log, but no faithfulness test, ablation, or comparison with human rationales is given.

Editorial extensions

If this is right

Security teams can upload log files to a chatbot, receive anomaly flags and explanations in one pass, and trace each flag to the tokens and attention heads that triggered it.
A 125M-parameter encoder model such as RoBERTa can serve anomaly detection with near-equal accuracy to 7B-parameter decoders while being far cheaper to deploy.
Post-hoc attention summaries can be stored per session, giving analysts an audit trail of why each log was flagged.
Natural-language reports with suggested actions can substitute for much of the manual investigation that currently consumes analyst time.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A straightforward test of the explanation layer would be an ablation: replace the entropy-selected heads with random heads and ask users whether the reports change in usefulness; if they do not, the attention summary is not carrying the explanatory value.
The paper does not compare its attention-based explanations against Captum's attribution scores or human-labeled rationales, so whether the reports reflect the model's true decision rule remains an open question.
The same Algorithm 1 could be applied to DeBERTa's disentangled attention or to decoder models, offering a cheap way to compare explanation quality across architectures.
Moving from uploaded files to real-time log streams, which the paper lists as future work, would allow measuring whether explanation-driven triage actually reduces response time in operational settings.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The actual new thing here is engineering: a working chatbot that wraps fine-tuned RoBERTa on the HDFS log dataset, pulls in BERTViz and Captum outputs, and uses GPT-4o to generate natural-language reports. As an integration of existing components, it is real and appears to function. The paper also deserves credit for being transparent about its own weak spots—the user study openly reports that only 2 of 13 participants fully trusted the predictions, 7 did not use or did not find the visualizations useful, and the tools timed out. That is honest reporting, not a sales job.

The soft spots are where the paper overreaches. The distinctive contribution is supposed to be 'high-quality explanations' that improve trust, but Algorithm 1—which averages attention over heads and layers, picks low-entropy heads, and lists top-token scores—has no faithfulness validation. No perturbation test, no ablation, no comparison against human rationales. Attention distributions are a well-known unreliable proxy for model reasoning, so the highlighted tokens and heads could easily be artifacts. The user study does not measure whether explanations changed decisions or reduced triage time. The abstract's claim that the framework 'reduces manual effort and speeds up remediation' is therefore not supported by the reported evidence.

One correction to the reader's note: the abstract does not claim RoBERTa outperforms Mistral-7B on accuracy—it says RoBERTa has 'better flexibility' than Mistral. Table 4 does show Mistral with perfect scores and RoBERTa with anomaly recall of 0.91, so the comparative claim against Falcon and DeBERTa is fine; the 'flexibility' claim is about deployability, which is plausible. Still, the single-run benchmark on 500 test samples without error bars or code is weak, and there is no baseline comparison against the cited conversational anomaly detectors ([5], [2]).

This paper deserves a serious referee because the system is functional and the problems are fixable: release code and data, run repeated seeds, validate explanation faithfulness with perturbation or rationale-based tests, and rerun the user study with actual security analysts rather than mostly ML researchers and students. As is, I would rate it conditional, with the explanation claims scaled back and the benchmark made statistically sound.

If I were handling it, I would send it to peer review with major revision expected. It is not a desk reject, but it is not a strong accept either.

Referee Report

5 major / 5 minor

Summary. The paper presents AnomalyExplainerBot, a conversational AI framework for detecting anomalies in HDFS system logs. The detection core is a fine-tuned RoBERTa-base classifier; explanations are produced by BERTViz and Captum and summarized through Algorithm 1, which averages attention, selects low-entropy heads, and reports top-attended tokens in natural language. The authors benchmark RoBERTa, DeBERTa, Falcon-7B, and Mistral-7B on a 500-sample test set, report that RoBERTa reaches 99.6% accuracy, and evaluate the chatbot with a 13-participant user study. The claimed contributions are the integrated conversational explainability pipeline, the comparative model study, and the user feedback indicating improved usability and understanding.

Significance. If the explanation-quality claim were substantiated, the paper would be a useful practical contribution: it demonstrates an end-to-end deployment of open-source explainability tools with a conversational interface, compares encoder- and decoder-based models, and reports real user reactions. The scaffold is well chosen for a systems/experience paper. However, the distinctive research claim - that the attention-based reports are 'high-quality explanations' that reduce manual effort and build trust - is not validated by the evidence. There is no faithfulness test, no ablation, no repeated-seed evaluation, and the user study is small and partially negative. The strengths are the modular architecture, the use of established open libraries, and the honest reporting of usability problems; the load-bearing evidence for the XAI contribution is missing.

major comments (5)

[§3.2, Algorithm 1] The central claim of 'high-quality explanations' is not supported by any faithfulness evaluation. Algorithm 1 averages attention over heads/layers, selects low-entropy heads, and reports top attended tokens, but there is no comparison with human rationales, no ablation, and no perturbation or causality test showing these patterns drive the classifier's decision. Attention can encode token frequency or special-token artifacts, so the NL reports could mislead analysts. The user study in §5.2 does not fill this gap: only 2/13 reported full trust and 7/13 did not use or did not find visualizations useful, and no measure of triage time or decision change was taken. Please add a faithfulness/utility experiment or temper the central claim.
[§3.4, Table 4] All detection numbers come from a single run on a 500-sample test set. No seeds, repeats, or confidence intervals are reported, so the accuracy/F1 differences among models are not statistically grounded. The abstract states RoBERTa 'outperforms' Falcon-7B and DeBERTa, but Table 4 shows Mistral-7B achieves perfect precision/recall/F1 while RoBERTa has anomaly recall 0.91; therefore the selection of RoBERTa must rest on efficiency, but no computation cost (latency, VRAM, FLOPs) is quantified. Report multiple seeds with standard deviations and a cost comparison.
[§3.4, §3.6] Reproducibility is impaired by missing dataset details. HDFS logs are normally labeled at the block/sequence level, but this paper says the classifier scores 'each log entry' with no explanation of how sequence labels were converted to entry-level labels. The class ratio in the extracted subset, the preprocessing/normalization steps, the token truncation policy, and the random seed are not given. With only 500 test samples, even a small class imbalance can drive accuracy; please provide a precise data card and split description.
[§3.2, Algorithm 1] Captum is claimed as an integrated XAI component, but Algorithm 1 takes only attentions and tokens as input; no Captum attribution is used in the report or in any quantitative evaluation. If Captum contributes only via separate visualizations, state that explicitly and give examples; if it is meant to be part of the unified report, include the attribution values in Algorithm 1 and evaluate them. As written, the explanation pipeline reduces to attention statistics, so the 'BERTViz and Captum' headline is only partially supported.
[§5.2, Table 7] The user study is too weak to support the abstract's claim that feedback 'confirms' improved understanding and trust. It has 13 participants, mostly developers and students (Table 5), not security analysts. Results show 7/13 'somewhat trust', 2/13 full trust, 1 low trust, and 7/13 did not use or did not find the visualizations useful. There is no pre/post measure, no task-completion time, and no comparison with a no-explanation baseline. Please report effect sizes and limitations, and avoid 'confirms'.

minor comments (5)

[Algorithm 1] The algorithm contains rendering errors: the stray text 'avg_entropy+10' appears before the algorithm, and the total_focus accumulation line reads '1 −9' instead of an explicit inverse-entropy formula. Please correct the pseudo-code and define all constants.
[§3.2] The values of top_k_tokens, top_k_heads, top_k_layers, and bias_threshold are never specified. Since these parameters determine the content of every explanation, a sensitivity analysis would be valuable.
[§4.1] The readability metrics (Flesch-Kincaid, Gunning Fog, SMOG) are interesting but are not connected to the user study or to any design decision; consider moving them to supplementary material or discussing their operational implications.
[Figures 3-4] The UI screenshots are hard to read in print, especially the BERTViz and Captum panels. Add annotations or higher-resolution figures that show exactly which visual element corresponds to a detected anomaly.
[General] No code, model weights, or anonymized participant responses are provided. For a framework paper with reproducibility claims, a link to the implementation and data-processing scripts would substantially strengthen the manuscript.

Circularity Check

0 steps flagged · score 2.0 of 10

No load-bearing circularity: the anomaly detection benchmark is independent and the explanation pipeline is post-hoc; the main weakness is unvalidated explanation faithfulness, not derivation-by-construction.

full rationale

The paper's central anomaly-detection claim rests on an external benchmark (HDFS from LogHub) and a straightforward comparison of four transformer models; no fitted parameter is renamed as a prediction. The explanation module (Algorithm 1) is explicitly post-hoc: it averages attention over heads/layers, computes entropy, and reports top tokens. This does not equate an output to an input by construction—it is a heuristic summary of the model's internal attention, and the report is generated from those statistics rather than from an independently predicted explanation target. The only self-citations are [4] and [5] in the related-work section; they support background claims about prior conversational anomaly-detection systems, but the present evaluation is self-contained and does not rely on those citations for its central results. The paper's own user study (Section 5.2) reveals that 7/13 participants did not use or did not find the visualization tools useful and only 2/13 reported full trust, which substantially weakens the 'high-quality explanations' claim. However, that is an empirical-validity/faithfulness concern, not a circularity in which the explanation is defined in terms of the prediction or vice versa. No equation-level circularity, no fitted-input-called-prediction, and no uniqueness theorem imported from the authors' prior work were found.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The system has no mathematical derivation to audit. The load-bearing assumptions are empirical: the HDFS labels and sample are trustworthy, attention-based summaries are faithful explanations, and 13 self-selected participants stand in for security analysts. The only hand-set parameters are the Algorithm 1 explanation knobs and the training budget; none are fit to data, but all affect what is reported.

free parameters (4)

top_k_tokens, top_k_heads, top_k_layers = not stated in paper
Algorithm 1 uses these hand-chosen counts to build the explanation report; results depend on them but no values are given.
special-token bias threshold (bias_threshold) = not stated in paper
Algorithm 1 compares average attention to a threshold for [CLS]/[SEP] bias warnings; threshold is chosen by hand and not reported.
training budget and split sizes = 3 epochs, 4000 train / 500 validation / 500 test
Section 3.6 fixes the benchmark; no hyperparameter search, no repeats, no class-balance statement, so the reported accuracies are contingent on these choices.
normal/anomaly class ratio in the extracted subset = not reported
Section 3.6 says normal and anomalous records were extracted but does not say the ratio; the anomaly recall numbers depend on it.

assumptions (4)

standard math Softmax attention rows are valid probability distributions, so entropy and means in Algorithm 1 are well-defined.
Algorithm 1 depends on standard properties of transformer attention; no special derivation needed.
domain assumption LogHub HDFS labels are correct, and the reshuffled 4,000/500/500 sample represents the full dataset.
Section 3.6 uses the public labeled HDFS subset but reports no label-noise analysis and no sampling seed; all accuracy claims inherit this assumption.
ad hoc to paper Average attention, low-entropy heads, and top tokens are meaningful explanations of the anomaly decision.
Section 3.2 and Algorithm 1 construct explanations from attention statistics without validating faithfulness against human rationales or ground-truth reasons.
domain assumption Self-reported feedback from 13 volunteer participants generalizes to security analysts.
Section 5 includes mostly developers, students, and ML engineers; only one participant is a security analyst; yet conclusions are framed around analysts.

how reviews work

0 comments

Cite this review

Pith. "Pith review of AnomalyExplainer Explainable AI for LLM-based anomaly detection using BERTViz and Captum." pith.science (2026). https://pith.science/paper/BNDFUENB

@misc{pith2026250900069,
  author       = {Pith},
  title        = {Pith review of: AnomalyExplainer Explainable AI for LLM-based anomaly detection using BERTViz and Captum},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BNDFUENB}},
  note         = {Machine review of arXiv:2509.00069}
}

read the original abstract

Conversational AI and Large Language Models (LLMs) have become powerful tools across domains, including cybersecurity, where they help detect threats early and improve response times. However, challenges such as false positives and complex model management still limit trust. Although Explainable AI (XAI) aims to make AI decisions more transparent, many security analysts remain uncertain about its usefulness. This study presents a framework that detects anomalies and provides high-quality explanations through visual tools BERTViz and Captum, combined with natural language reports based on attention outputs. This reduces manual effort and speeds up remediation. Our comparative analysis showed that RoBERTa offers high accuracy (99.6 %) and strong anomaly detection, outperforming Falcon-7B and DeBERTa, as well as exhibiting better flexibility than large-scale Mistral-7B on the HDFS dataset from LogHub. User feedback confirms the chatbot's ease of use and improved understanding of anomalies, demonstrating the ability of the developed framework to strengthen cybersecurity workflows.

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

(EC)2: Event-Centric Explainability for Cybersecurity Through Multi-Agent LLM Investigations
cs.CR 2026-07 reject novelty 5.0 of 10

An event-centric, multi-agent LLM framework explains network alerts through hypothesis-driven, retrieval-augmented investigation and claims to improve explanation quality and boundary-case classification.

Reference graph

Works this paper leans on

25 extracted references · 16 canonical work pages · cited by 1 Pith paper

[5]

black -box

Practical Implementation, User Study, and Insights: We demonstrate the effective deployment of the proposed framework in a cybersecurity context, supported by a user study that highlights its usability, interpretability, and impact on analyst trust. The study also discusses infrastructure challenges and considerations for real-world adoption. 2 Related Wo...

work page 2022
[2]

These visual explanations are seamlessly integrated into the user interface to enhance interpretability

Integration of Explainability Tools: The framework incorporates high-end Explainable AI(XAI) tools such as BERTViz and Captum to analyze and justify LLM’s decisions. These visual explanations are seamlessly integrated into the user interface to enhance interpretability

work page
[1]

Development of a Conversational AI Framework: We present a novel conver - sational AI system that uses advanced LLMs to detect anomalies in log data and explain them interactively through a user-friendly chatbot interface

work page
[3]

This improves usability, reduces manual effort, and encourages a wider adoption of LLMs in cybersecurity workflows

Conversational Explainability for Enhanced Trust: The system offers conver- sational assistance focused on explaining model decisions, increasing trust in LLM outputs. This improves usability, reduces manual effort, and encourages a wider adoption of LLMs in cybersecurity workflows

work page
[4]

RoBERTa was ulti- mately selected as the optimal choice due to its high accuracy and practical performance

Comparative Study of LLM Architectures: We conduct a comparative anal- ysis of encoder -based and decoder -based LLMs to identify models that are efficient and lightweight for real -time anomaly detection. RoBERTa was ulti- mately selected as the optimal choice due to its high accuracy and practical performance

work page
[6]

Log File Analysis Based on Machine Learning: A Survey: Survey

Rawand Raouf Abdalla and Alaa Khalil Jumaa. “Log File Analysis Based on Machine Learning: A Survey: Survey”. In: UHD Journal of Science and Technology 6.2 (2022), pp. 77–84

work page 2022
[7]

Huntgpt: Integrating machine learning - based anomaly detec tion and explainable ai with large language models (llms)

Tarek Ali and Panos Kostakos. “Huntgpt: Integrating machine learning - based anomaly detec tion and explainable ai with large language models (llms)”. In: arXiv preprint arXiv:2309.16021 (2023)

arXiv 2023
[8]

The falcon series of open language models

Ebtesam Almazrouei et al. “The falcon series of open language models”. In: arXiv preprint arXiv:2311.16867 (2023)

arXiv 2023

Show all 25 references

[9]

Cygent: A cybersecurity conversational agent with log summarization powered by gpt-3

Prasasthy Balasubramanian, Justin Seby, and Panos Kostakos. “Cygent: A cybersecurity conversational agent with log summarization powered by gpt-3”. In: 2024 3rd International Conference on Artificial Intelligence For Internet of Things (AIIoT). IEEE. 2024, pp. 1–6

2024
[10]

Transformer-based llms in cybersecurity: An in-depth study on log anomaly detection and conversational defense mechanisms

Prasasthy Balasubramanian, Justin Seby, and Panos Kostakos. “Transformer-based llms in cybersecurity: An in-depth study on log anomaly detection and conversational defense mechanisms”. In: 2023 IEEE Interna - tional Conference on Big Data (BigData). IEEE. 2023, pp. 3590–3599. ...

2023
[11]

What does bert look at? an analysis of bert’s attention

Kevin Clark et al. “What does bert look at? an analysis of bert’s attention”. In: arXiv preprint arXiv:1906.04341 (2019)

1906 arXiv
[12]

2023 Cybersecurity Almanac: 100 Facts, Figures, Predictions, And Statistics

Cybersecurity Ventures. 2023 Cybersecurity Almanac: 100 Facts, Figures, Predictions, And Statistics . 2023. url: https://cybersecurityventures. com/cybersecurity-almanac-2023/ (visited on 06/14/2025)

2023
[13]

Machine learning based anomaly detection of log files using ensemble learning and self -attention

M. Fält, S. Forsström, and T. Zhang. “Machine learning based anomaly detection of log files using ensemble learning and self -attention”. In: 2021 5th International Conference on System Reliability and Safety (ICSRS) (2021). doi: 10.1109/icsrs53853.2021.9660694

2021
[14]

LLMeLog: An Approach for Anomaly Detection based on LLM-enriched Log Events

Minghua He et al. “LLMeLog: An Approach for Anomaly Detection based on LLM-enriched Log Events”. In: 2024 IEEE 35th International Symposium on Software Reliability Engineering (ISSRE). IEEE. 2024, pp. 132–143

2024
[15]

Deberta: Decoding -enhanced bert with disentangled attention

Pengcheng He et al. “Deberta: Decoding -enhanced bert with disentangled attention”. In: arXiv preprint arXiv:2006.03654 (2020)

2006 arXiv
[16]

Captum: A unified and generic model interpretabil- ity library for pytorch

Narine Kokhlikyan et al. “Captum: A unified and generic model interpretabil- ity library for pytorch”. In: arXiv preprint arXiv:2009.07896 (2020)

2009 arXiv
[17]

Roberta: A robustly optimized bert pretraining approach

Yinhan Liu et al. “Roberta: A robustly optimized bert pretraining approach”. In: arXiv preprint arXiv:1907.11692 (2019)

1907 arXiv
[18]

Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1

National Institute of Standards and Technology. Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1. Apr. 2018. doi: 10.6028/ NIST . CSWP . 04162018. url: https :// nvlpubs . nist . gov / nistpubs / cswp/nist.cswp.04162018.pdf (visited on 06/20/2025)

2018
[19]

Yarn: Efficient context window extension of large language models

Bowen Peng et al. “Yarn: Efficient context window extension of large language models”. In: arXiv preprint arXiv:2309.00071 (2023)

2023 arXiv
[20]

Explainable AI for cybersecurity automation, intelli - gence and trustworthiness in digital twin: Methods, taxonomy, challenges and prospects

Iqbal H Sarker et al. “Explainable AI for cybersecurity automation, intelli - gence and trustworthiness in digital twin: Methods, taxonomy, challenges and prospects”. In: ICT Express (2024)

2024
[21]

IoT Dynamic Log File Analysis: Security Approach f or Anomaly Detection In Multi Sensor Environment

Monika Saxena. “IoT Dynamic Log File Analysis: Security Approach f or Anomaly Detection In Multi Sensor Environment”. In: International research journal of modernization in engineering technology & Science 3 (2021), pp. 2582–5208

2021
[22]

A survey on forensic investigation of operating system logs

H. Studiawan, F. Sohel, and C. Payne. “A survey on forensic investigation of operating system logs”. In: Digital Investigation 29 (2019), pp. 1–20. doi: 10.1016/j.diin.2019.02.005

2019 doi
[23]

Cldtlog: system log anomaly detection method based on contrastive learning and dual objective tasks

G. Tian et al. “Cldtlog: system log anomaly detection method based on contrastive learning and dual objective tasks”. In: Sensors 23 (11 2023), p. 5042. doi: 10.3390/s23115042

2023 doi
[24]

BertViz: A tool for visualizing multihead self -attention in the BERT model

Jesse Vig. “BertViz: A tool for visualizing multihead self -attention in the BERT model”. In: ICLR workshop: Debugging machine learning models . Vol. 3. 2019

2019
[25]

Loghub: A large collection of system log datasets for ai-driven log analytics

Jieming Zhu et al. “Loghub: A large collection of system log datasets for ai-driven log analytics”. In: 2023 IEEE 34th International Symposium on Software Reliability Engineering (ISSRE). IEEE. 2023, pp. 355–366

2023

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.

[1] [5]

black -box

Practical Implementation, User Study, and Insights: We demonstrate the effective deployment of the proposed framework in a cybersecurity context, supported by a user study that highlights its usability, interpretability, and impact on analyst trust. The study also discusses infrastructure challenges and considerations for real-world adoption. 2 Related Wo...

work page 2022

[2] [2]

These visual explanations are seamlessly integrated into the user interface to enhance interpretability

Integration of Explainability Tools: The framework incorporates high-end Explainable AI(XAI) tools such as BERTViz and Captum to analyze and justify LLM’s decisions. These visual explanations are seamlessly integrated into the user interface to enhance interpretability

work page

[3] [1]

Development of a Conversational AI Framework: We present a novel conver - sational AI system that uses advanced LLMs to detect anomalies in log data and explain them interactively through a user-friendly chatbot interface

work page

[4] [3]

This improves usability, reduces manual effort, and encourages a wider adoption of LLMs in cybersecurity workflows

Conversational Explainability for Enhanced Trust: The system offers conver- sational assistance focused on explaining model decisions, increasing trust in LLM outputs. This improves usability, reduces manual effort, and encourages a wider adoption of LLMs in cybersecurity workflows

work page

[5] [4]

RoBERTa was ulti- mately selected as the optimal choice due to its high accuracy and practical performance

Comparative Study of LLM Architectures: We conduct a comparative anal- ysis of encoder -based and decoder -based LLMs to identify models that are efficient and lightweight for real -time anomaly detection. RoBERTa was ulti- mately selected as the optimal choice due to its high accuracy and practical performance

work page

[6] [6]

Log File Analysis Based on Machine Learning: A Survey: Survey

Rawand Raouf Abdalla and Alaa Khalil Jumaa. “Log File Analysis Based on Machine Learning: A Survey: Survey”. In: UHD Journal of Science and Technology 6.2 (2022), pp. 77–84

work page 2022

[7] [7]

Huntgpt: Integrating machine learning - based anomaly detec tion and explainable ai with large language models (llms)

Tarek Ali and Panos Kostakos. “Huntgpt: Integrating machine learning - based anomaly detec tion and explainable ai with large language models (llms)”. In: arXiv preprint arXiv:2309.16021 (2023)

arXiv 2023

[8] [8]

The falcon series of open language models

Ebtesam Almazrouei et al. “The falcon series of open language models”. In: arXiv preprint arXiv:2311.16867 (2023)

arXiv 2023