An explainable and latency-aware unified framework for hybrid graph cyberattack detection

Explainable artificial intelligence (XAI) has emerged as a vital necessity to deploy Artificial Intelligence based cyberattack detection systems in operational Security Operations Centers (SOCs) when an analyst needs to quickly triage large volumes of alerts with strict time limitations. Although the new intrusion detection systems have high levels of detection, they do not provide the actionable explanations, which help in building the trust of the analyst and making decisions. The paper introduces an explainability-oriented cyberattack detection model, which consists of various alternative explanation models over a fixed hybrid detection backbone based on heterogeneous graph transformers (HGT), temporal sequence modeling by LSTM, and ensemble classification by XGBoost. The proposed system integrates a feature-level attribution through SHAP, anomaly-level through autoencoder reconstruction errors and the relational background through graph-based attention analysis, which builds a single and analyst-friendly report on the explanations of each network flow. Instead of introducing a new detection algorithm, this paper concentrates on the systematic introduction and performance analysis of explainability within the context of real-time SOC. The framework is tested on the dataset of UNSW-NB15 where the key aspects are fidelity of explainability, computational cost, and the practical usability. The outcome indicates the proposed explainability pipeline carries a low latency overhead of about 25 ms per flow while improving analyst triage accuracy by 14%in controlled evaluation settings. An analyst based test also illustrates how multi-modal explanation is especially useful in promoting quicker and more confident alert triage. Overall, this article demonstrates the need to reconcile explainable cyberattack detection with the constraints of the operational world, which is a plausible step towards trustworthy and deployable AI-based security systems.