Research Focus — Pillar 1
One argument in six parts: why black-box intrusion detection is a national-security problem, and what trustworthy, human-centered AI defense actually looks like.
01
An AI is deciding what counts as a cyberattack on critical systems — and often it can't say why.
Machine learning powers the intrusion-detection systems behind hospitals, power grids, and water systems. They are fast and they catch what humans miss. But an alarm without a reason forces an impossible choice on the analyst receiving it: act on faith, or wait and risk a breach.
02
The biggest weakness in AI cyber-defense isn't accuracy. It's that no one can act on what it says.
A single operations center can see tens of thousands of alerts a day, most of them false alarms. Add a model that flags threats without explaining them and analysts can no longer separate signal from noise — so they tune out, which is exactly when a genuine attack slips through.
We call it alert fatigue, but underneath it is a trust problem: people don't act on a system they can't understand. The fix isn't a more accurate black box. It's a model that shows its work, turning an alert into a decision someone can defend.
03
What if a cyber-defense AI could point to the exact signals that made it call something an attack?
Explainable AI (XAI) changes what a security model outputs. Instead of only “attack” or “safe,” an explainable model highlights the features that drove the decision — this traffic pattern, this timing, this behavior. My work brings that transparency to network intrusion detection, tested on established benchmark datasets such as CICIDS2017 so results stay measurable and comparable rather than merely claimed.
The goal is a glass box: as capable as the black box, but one a human can look inside.
04
The same alert should look different to a veteran analyst and to a small-town utility operator — and most systems ignore that.
An explanation is only useful if the person receiving it can understand it. A seasoned security engineer and the operator of a small water utility have very different backgrounds, yet both defend critical infrastructure and both may be staring at the same AI alert.
My contribution is persona-adaptive explanation: matching how the system explains itself to the technical literacy of the reader, generated on-device so sensitive data never leaves the network. This is the basis of a patent-pending (provisional) approach.
05
Making AI explainable sounds obvious — so why isn't every security system built that way?
Naming these honestly is part of doing the work responsibly.
06
The next decade of national security will be won or lost on whether we can trust the AI defending us.
As more of our defense is handed to AI, explainability stops being a nice-to-have and becomes a requirement. Recent U.S. federal guidance on AI in critical infrastructure names the lack of explainability as a core risk — precisely the gap this research works to close.
The aim is intrusion detection that is transparent, human-centered, and trustworthy enough to protect the hospitals, grids, and utilities everyday life depends on.
Trustworthy AI isn't a feature of national defense. It's the foundation of it.
Each part of this argument is also a short video. Posts embed below as they publish.
Embeds load from linkedin.com and only render on a page served over http(s) — open the site through a web server or a live host rather than double-clicking the file. Duplicate one block per additional clip; the grid reflows on its own.
This page summarizes an ongoing research program for a general audience. Figures and claims are kept deliberately conceptual; formal results belong in peer-reviewed venues.