SPLAIN: Augmenting Cybersecurity Warnings with Reasons and Data

TL;DR

SPLAIN is a natural language generator that transforms cybersecurity warning data into clear, hierarchical explanations, enhancing user understanding and trust in threat alerts.

Contribution

This paper introduces SPLAIN, a template-based system that produces hierarchical, user-friendly explanations for cyber threat warnings, addressing limitations of prior unconvincing alerts.

Findings

SPLAIN generates coherent, actionable threat explanations.

Hierarchical explanations improve user comprehension.

Template-based approach ensures consistent warning structures.

Abstract

Effective cyber threat recognition and prevention demand comprehensible forecasting systems, as prior approaches commonly offer limited and, ultimately, unconvincing information. We introduce Simplified Plaintext Language (SPLAIN), a natural language generator that converts warning data into user-friendly cyber threat explanations. SPLAIN is designed to generate clear, actionable outputs, incorporating hierarchically organized explanatory details about input data and system functionality. Given the inputs of individual sensor-induced forecasting signals and an overall warning from a fusion module, SPLAIN queries each signal for information on contributing sensors and data signals. This collected data is processed into a coherent English explanation, encompassing forecasting, sensing, and data elements for user review. SPLAIN's template-based approach ensures consistent warning structure and vocabulary. SPLAIN's hierarchical output structure allows each threat and its components to be expanded to reveal underlying explanations on demand. Our conclusions emphasize the need for designers to specify the "how" and "why" behind cyber warnings, advocate for simple structured templates in generating consistent explanations, and recognize that direct causal links in Machine Learning approaches may not always be identifiable, requiring some explanations to focus on general methodologies, such as model and training data.