X-SIEM Framework Integrating Rule-Based ML and LLMs for Cyber Threat Intelligence

Jul 3, 2026

Security Operations Centers face alert fatigue as conventional SIEM platforms produce high volumes of alerts, many of which are false positives. Machine-learning approaches further introduce an explainability gap, reducing analyst trust and complicating compliance. The paper proposes a three-layer hybrid SIEM framework combining a rule engine, a hybrid ML ensemble (Random Forest and Isolation Forest), and a fine-tuned LLM that generates interpretable explanations and response guidance. Evaluation on CICIDS datasets reports 98.7% precision and an 82% false-positive reduction.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages6

Reading Time15 min

Introduction

Related Work

2025 28th International Conference on Computer and Information Technology (ICCIT) ©2025 IEEE DOI: 10.1109/ICCIT68739.2025.11491524| 979-8-3315-7867-1/25/$31.00 | 2025 28th International Conference on Computer and Information Technology (ICCIT) 19–21 December 2025, Cox’s Bazar, Bangladesh X-SIEM Framework: Integrating Rule-Based, ML, and LLMs for Cyber Threat Intelligence Md Fahim Al Shihab, Sabbir Ahmed Al Seum, Md. Atikur Rahman, Ragib Nadim, Albar Hossain Rafi, Tonny Shekha Kar Department of Computer Science and Engineering, American International University–Bangladesh (AIUB), Dhaka, Bangladesh Emails: [22-46945-1@student.aiub.edu](22-46945-1@student.aiub.edu), [22-47196-1@student.aiub.edu](22-47196-1@student.aiub.edu), [22-47944-2@student.aiub.edu](22-47944-2@student.aiub.edu), [23-50683-1@student.aiub.edu](23-50683-1@student.aiub.edu), [21-45093-2@student.aiub.edu](21-45093-2@student.aiub.edu), [tonny.kar@aiub.edu](tonny.kar@aiub.edu) Abstract—Security Operations Centers (SOCs) are increasingly challenged by alert fatigue, with traditional Security Information and Event Management (SIEM) systems generating thousands of daily alerts, a significant portion of which are false positives. Concurrently, the adoption of machine learning (ML) for threat detection has introduced a ”black box” problem, where the lack of explainability hinders analyst trust and compliance with regulations. This paper presents a novel three-layer hybrid SIEM framework designed to bridge the gap between detection accuracy and operational interpretability. The framework synergistically combines a high-speed rule engine, a hybrid ML ensemble (Random Forest and Isolation Forest), and a fine-tuned Large Language Model (LLM) for explanation and response generation. The framework was evaluated on the CICIDS-2017 and CICIDS- 2018 benchmark datasets, achieving a 98.7% precision and an 82% reduction in false positives compared to a baseline rulebased system. Furthermore, the LLM-generated explanations, mapped to the MITRE ATT&CK framework, reduced the meantime to respond (MTTR) by 58% in simulated analyst workflows. Statistical significance testing confirmed our results (p ¡ 0.01), and comprehensive ablation studies validated our architectural choices. Our results demonstrate that this integrated approach not only enhances the accuracy of threat detection but also provides the actionable, transparent intelligence necessary for modern cybersecurity operations. Index Terms—Cybersecurity, SIEM, Explainable AI (XAI), Large Language Models (LLMs), Threat Intelligence, Machine Learning, Hybrid Detection I. INTRODUCTION Modern digital companies face an endless barrage of sophisticated cyberattacks. Security Operations Centers (SOCs) are leading the defence, but they are struggling under the weight of overwhelming data volumes. A typical SOC can handle more than 10,000 daily alerts [1], leading to high analyst exhaustion and a likely miss of real threats in background noise. Traditional SIEM systems, although central to SOC operations, frequently suffer from high false-positive rates (up to 40%) and an inability to detect new zero-day attacks [2] . To resolve this, next-generation SIEMs have incorporated machine learning (ML) models, which have demonstrated significant success in reporting anomalous patterns consistent with attacks [3] . However, this has created new challenges: the interpretability paradox. Complex models like deep neural networks or large ensembles are black boxes, producing alerts without a clear rationale. The lack of transparency in automated systems undermines analyst trust, complicates forensic investigations, and poses compliance risks under regulations like the GDPR, which mandate a right to explanation. [4] . This paper closesthe gap in imperative detection of explainable and actionable intelligence. Unlike previous work that focuses primarily on detection accuracy, this concept incorporates three synergistic detect

FAQs

What problem does the proposed X-SIEM framework address in SOC operations?

It targets alert fatigue caused by large numbers of low-quality SIEM alerts and the interpretability paradox introduced by ML “black box” models, which reduces analyst trust and increases compliance risk.

How does the framework combine rule-based, ML, and LLM components?

It uses a fast adaptive rule engine for known threats, a hybrid ML ensemble (Random Forest and Isolation Forest) for known and unknown anomalies, and a fine-tuned LLM to convert complex alerts into human-readable explanations and actionable response plans.

What evaluation results and validation methods are reported?

Experiments on CICIDS-2017 and CICIDS-2018 achieve 98.7% precision and an 82% reduction in false positives versus a baseline rule-based system. LLM explanations mapped to MITRE ATT&CK reduce MTTR by 58% in simulated workflows, with significance testing (p < 0.01) and ablation studies supporting design choices.

Jul 3, 2026

Upload by Genevieve