  Machine learning (ML) on graph-structured data has recently received deepened
interest in the context of intrusion detection in the cybersecurity domain. Due
to the increasing amounts of data generated by monitoring tools as well as more
and more sophisticated attacks, these ML methods are gaining traction.
Knowledge graphs and their corresponding learning techniques such as Graph
Neural Networks (GNNs) with their ability to seamlessly integrate data from
multiple domains using human-understandable vocabularies, are finding
application in the cybersecurity domain. However, similar to other
connectionist models, GNNs are lacking transparency in their decision making.
This is especially important as there tend to be a high number of false
positive alerts in the cybersecurity domain, such that triage needs to be done
by domain experts, requiring a lot of man power. Therefore, we are addressing
Explainable AI (XAI) for GNNs to enhance trust management by exploring
combining symbolic and sub-symbolic methods in the area of cybersecurity that
incorporate domain knowledge. We experimented with this approach by generating
explanations in an industrial demonstrator system. The proposed method is shown
to produce intuitive explanations for alerts for a diverse range of scenarios.
Not only do the explanations provide deeper insights into the alerts, but they
also lead to a reduction of false positive alerts by 66% and by 93% when
including the fidelity metric.
