HuntGPT: Integrating Machine Learning-Based Anomaly Detection and Explainable AI with Large Language Models (LLMs)

Sep 4, 2026

Uploaded by Rizky

Machine learning approaches for network anomaly detection strengthen proactive threat hunting by reducing time to detect and respond, yet training and maintenance burdens and frequent false positives undermine trust. Explainable AI techniques have been proposed to help cybersecurity teams evaluate AI alerts, but incident responders and model maintainers still face decision-making gaps. HuntGPT integrates a Random Forest anomaly detector trained on KDD99 with XAI methods (SHAP, LIME) and a GPT-3.5 Turbo conversational agent, producing threats in a transparent, user-friendly format.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages10

Reading Time25 min

AccessFree to download

Abstract

I. Introduction

Cyber Threat Hunting and Operational Challenges

Machine Learning Anomaly Detection and False Positives

Explainable AI in Cybersecurity

Large Language Models for Actionable Responses

arXiv :2309 . 16021v1 [ cs .CR] 27 Sep 2023 HuntGPT: Integrating Machine Learning-Based Anomaly Detection and Explainable AI with Large Language Models (LLMs) Tarek Ali and Panos Kostakos Faculty of Information Technology and Electrical Engineering Center for Ubiquitous Computing University of Oulu Oulu, Finland 90570 Tarek.Ali, [Panos.Kostakos@oulu.fi](Panos.Kostakos@oulu.fi) Abstract—Machine learning (ML) methods for network anomaly detection are emerging as effective proactive strategies in threat hunting, substantially reducing the time required for threat detection and response. However, the challenges in training and maintaining ML models, coupled with frequent false positives, diminish their acceptance and trustworthiness. In response, Explainable AI (XAI) techniques have been introduced to enable cybersecurity operations teams to assess alerts generated by AI systems more confidently. Despite these advancements, XAI tools have encountered limited acceptance from incident responders and have struggled to meet the decision-making needs of both analysts and model maintainers. Large Language Models (LLMs) offer a unique approach to tackling these challenges. Through tuning, LLMs have the ability to discern patterns across vast amounts of information and meet varying functional requirements. In this research, we introduce the development of HuntGPT, a specialized intrusion detection dashboard created to implement a Random Forest classifier trained utilizing the KDD99 dataset. The tool incorporates XAI frameworks like SHAP and Lime, enhancing user-friendliness and intuitiveness of the model. When combined with a GPT-3.5 Turbo conversational agent, HuntGPT aims to deliver detected threats in an easily explainable format, emphasizing user understanding and offering a smooth interactive experience. We investigate the system’s comprehensive architecture and its diverse components, assess the prototype’s technical accuracy using the Certified Information Security Manager (CISM) Practice Exams, and analyze the quality of response readability across six unique metrics. Our results indicate that conversational agents, underpinned by LLM technology and integrated with XAI, can enable a robust mechanism for generating explainable and actionable AI solutions, especially within the realm of intrusion detection systems. Index Terms—Intrusion Detection, Security, ChatGPT, XAI, Chatbots, OpenAI, Explainable AI, Security Awareness I. INTRODUCTION In recent decades, there has been a substantial escalation in cyber-attacks targeting critical and enterprise infrastructure. By 2025, anticipated annual financial damages from these cyber-attacks are projected to reach $10.5 trillion USD, a substantial leap from $3 trillion USD recorded in 2015 [1] . To counteract the evolving cyber threats, the National Institute of Standards and Technology (NIST) introduced a Cybersecurity Framework in 2014 . This framework prescribes iterative cybersecurity policies for identification, protection, detection, response, and recovery processes related to cyber incidents [2] . In this backdrop, human experts play a vital role in analysing extensive telemetry data and Indicators of Compromise (IoC) to isolate real threats [3, 4] . Consequently, building on the foundation laid by the NIST Framework, an extensive ecosystem—comprising tools, methodologies, and techniques—has been established to enable the proactive identification of threats, a process referred to as Cyber Threat Hunting (CTH) [5, 6, 7] . Threat hunting tools enable analysts to apply their specialized knowledge to formulate and test threat hypotheses by analysing system telemetry as well as threat intelligence from external sources [3] . Machine learning-based anomaly detection tools are particularly noteworthy, designed to uncover both known and unknown threats. Generally, network anomalies are categorized into performance-related, such as file server failuresand transient

FAQs

What problem does HuntGPT target in intrusion detection?

HuntGPT targets the gap between ML-based intrusion detection outputs and the decision-making needs of analysts and model maintainers, especially under false positives and limited XAI adoption.

Which model and dataset does HuntGPT use for anomaly detection?

HuntGPT uses a Random Forest classifier trained with the KDD99 dataset to classify acquired network packets.

How does HuntGPT make detections explainable to users?

It incorporates XAI frameworks such as SHAP and LIME and combines them with a GPT-3.5 Turbo conversational agent to present detected threats in an easily explainable format.

Sep 4, 2026

Uploaded by Rizky