An Explainable AI Agent Based Assistant for Real-Time Cyber Threat Detection and Personalized Security Recommendations

In the era of escalating cyber threats, traditional black-box intrusion detection systems (IDS) suffer from lack of transparency, high false-positive rates, and inability to provide actionable guidance to diverse users.This paper proposes an Explainable AI (XAI) AgentBased Assistant that unifies real-time threat detection with personalized security recommendations.The system integrates a hybrid CNN-LSTM detection backbone optimized for spatialtemporal network traffic analysis, achieving 98.7% accuracy and 98.6% F1-score on benchmark datasets (CICIDS2017, NSL-KDD) with sub-50ms explanation latency through optimized SHAP and LIME implementations using INT8 quantization and LRU caching.A Dynamic Explainable Framework (DEF) couplesdetection with explanation-aware alert prioritization, reducing residual false positives by 50% while improving macro precision by 2.8 points.The Personalization Enginemodels user risk appetite, historical behaviour, and role context to generate adaptive mitigation playbooks.A humanin-the-loop feedback loop enables continuous learning and trust calibration.Experimental evaluation demonstrates sustained throughput of 315 alerts per second and analyst trust improvement of 31% when explanations are presented.The architecture is designed for SOC deployment, compliance auditing, and edge applicability.