An Explainable AI Framework for Real-Time Cyberattack Detection and Risk Assessment

As cyberattacks become more sophisticated and more common, detection systems must be not only accurate but also quick and easy to interpret. Although deep learning models have proven to be very effective in detecting intrusion and malware, their black-box nature has hindered their adoption in security operations centers (SOCs), where analysts need to explain and take action on alerts in short timeframes. To offer real-time cyberattack detection with quantitative risk assessment, this paper presents an Explainable AI (XAI) framework that integrates a lightweight hybrid deep learning detector with post-hoc and intrinsic explainability methods. The framework combines a Convolutional-Bidirectional Gated Recurrent Unit (CNN-BiGRU) architecture for spatio-temporal traffic representation with an attention layer that highlights salient time steps and integrates SHAP (Shapley Additive explanations) and LIME (Local Interpretable Model-agnostic Explanations) to generate human-readable justifications for every prediction. A dynamic risk-scoring engine then translates detection confidence, feature-level severity, and asset criticality to a normalized risk index that enables prioritized incident response. The framework is tested on three benchmark intrusion detection datasets (CICIDS2017, NSL-KDD, and UNSW-NB15) and a real-time traffic stream generated synthetically. Experimental results reveal that the proposed model achieves a detection accuracy of 98.6%, achieves an F1-score of 0.981, and the average latency of inference is 14.2 milliseconds per flow, and explanation fidelity, based on the two metrics of deletion/insertion and rank-correlation stability, demonstrates that the explanations generated are faithful to the model's behavior. It has been shown that the proposed hybrid framework is suitable for application in real-time network security environments with limited resources, as it outperforms the standalone CNN, LSTM, Random Forest, and CNN-LSTM baselines in terms of detection performance and retains interpretability with only a minor computational cost. It also demonstrates the applicability of the framework for security operations workflows by means of a comprehensive ablation study, ROC and confusion-matrix analysis, and a comparison with the dynamic risk index and static CVSS-style scoring.