AI-enabled event detection and signature engineering for cybersecurity using LLMs with explainability and interpretability
Thesis event information
Date and time of the thesis defence
Place of the thesis defence
Lecture Hall IT116, Linnanmaa Campus
Topic of the dissertation
AI-enabled event detection and signature engineering for cybersecurity using LLMs with explainability and interpretability
Doctoral candidate
Master of Science (with Distinction) in Data Science Prasasthy Balasubramanian
Faculty and unit
University of Oulu Graduate School, Faculty of Information Technology and Electrical Engineering, Centre of Applied Computing
Subject of study
Computer Science and Engineering
Opponent
Professor Raghava Rao Mukkamala, Copenhagen Business School
Custos
Docent, Associate Professor Panagiotis Kostakos, University o f Oulu
Using artificial intelligence to detect cyber threats and generate transparent security rules
Cyberattacks are becoming increasingly complex, and cybersecurity teams must analyse large amounts of information to identify threats and protect computer systems and networks. Artificial intelligence (AI) can help automate this work, but it is also important for security professionals to understand how AI reaches its conclusions and how its results can be used in practice.
This dissertation investigates how AI, including large language models, can support different stages of cybersecurity. It brings together research on collecting cyber threat information, detecting unusual activity in system logs, analysing network traffic, summarising technical information, explaining detection results, and automatically generating security rules and signatures.
The research explores methods for gathering cyber threat information from different online sources and transforming technical data into useful information for security analysis. It investigates how AI models can identify suspicious patterns in system logs and produce summaries that help analysts understand security events. It also examines how AI can analyse hexadecimal data representing captured network traffic to identify malicious activity, generate human-readable intrusion detection alerts, and support the automatic generation of security signatures. These signatures help network security systems recognise patterns associated with potential threats.
Another important aspect of the dissertation is making AI-supported cybersecurity more understandable. The research explores methods for explaining detection results and interpreting AI-generated outputs so that security professionals can better understand suspicious events and assess the results.
Overall, this research contributes to the development of AI-enabled cybersecurity methods that combine automation with human understanding. By supporting threat intelligence collection, system-log analysis, network threat detection, and security-signature generation, AI can help security professionals investigate threats and develop detection rules more efficiently. The dissertation also highlights the importance of understandable AI outputs in supporting informed decisions in practical cybersecurity settings.
This dissertation investigates how AI, including large language models, can support different stages of cybersecurity. It brings together research on collecting cyber threat information, detecting unusual activity in system logs, analysing network traffic, summarising technical information, explaining detection results, and automatically generating security rules and signatures.
The research explores methods for gathering cyber threat information from different online sources and transforming technical data into useful information for security analysis. It investigates how AI models can identify suspicious patterns in system logs and produce summaries that help analysts understand security events. It also examines how AI can analyse hexadecimal data representing captured network traffic to identify malicious activity, generate human-readable intrusion detection alerts, and support the automatic generation of security signatures. These signatures help network security systems recognise patterns associated with potential threats.
Another important aspect of the dissertation is making AI-supported cybersecurity more understandable. The research explores methods for explaining detection results and interpreting AI-generated outputs so that security professionals can better understand suspicious events and assess the results.
Overall, this research contributes to the development of AI-enabled cybersecurity methods that combine automation with human understanding. By supporting threat intelligence collection, system-log analysis, network threat detection, and security-signature generation, AI can help security professionals investigate threats and develop detection rules more efficiently. The dissertation also highlights the importance of understandable AI outputs in supporting informed decisions in practical cybersecurity settings.
Created 9.10.2026 | Updated 12.10.2026