SPLAIN: Augmenting Cybersecurity Warnings with Reasons and Data
Vera A. Kazakova Jena D. Hwang Bonnie J. Dorr Yorick Wilks J. Blake Gage Alex Memory Mark A. Clark
Effective cyber threat recognition and prevention demand comprehensible
forecasting systems, as prior approaches commonly offer limited and,
ultimately, unconvincing information. We introduce Simplified Plaintext
Language (SPLAIN), a natural language generator that converts warning data into
user-friendly cyber threat explanations. SPLAIN is designed to generate clear,
actionable outputs, incorporating hierarchically organized explanatory details
about input data and system functionality. Given the inputs of individual
sensor-induced forecasting signals and an overall warning from a fusion module,
SPLAIN queries each signal for information on contributing sensors and data
signals. This collected data is processed into a coherent English explanation,
encompassing forecasting, sensing, and data elements for user review. SPLAIN's
template-based approach ensures consistent warning structure and vocabulary.
SPLAIN's hierarchical output structure allows each threat and its components to
be expanded to reveal underlying explanations on demand. Our conclusions
emphasize the need for designers to specify the "how" and "why" behind cyber
warnings, advocate for simple structured templates in generating consistent
explanations, and recognize that direct causal links in Machine Learning
approaches may not always be identifiable, requiring some explanations to focus
on general methodologies, such as model and training data.