| Kurzfassung | Networks worldwide are facing increasing pressure from cyberattacks. For cybersecurity, Reinforcement Learning (RL) agents have demonstrated promising potential, enhancing network resilience and fortifying cybersecurity posture. However, particularly in critical scenarios, it is imperative to ensure the dependability of RL agents to foster operator trust. Therefore, this thesis explores and discusses Explainable Artificial Intelligence (XAI) methodologies for Multi Agent Reinforcement Learning (MARL) defending cyber-critical networks. These XAI mechanisms were implemented using Shapley values and decision trees. Furthermore, a novel hybrid approach was developed combining a Large Language Model (LLM), neurosymbolic outputs, and Shapley values. Afterwards, the MARL was explained via the three XAI implementations. Moreover, experts in the field of RL for cyber security investigated the trained MARL; the expert knowledge was contrasted with the XAI explanations. From the XAI and expert insights, a strategy improving the MARL was proposed, employing imitation learning to reinforce the significance of underrepresented features in the agents’ outputs. Lastly, the presented XAI tools were critically assessed within the framework of a structured discussion methodology. The XAI tools demonstrate promising potential in explainingMARL, illustrated by the improvements in the agents’ feature relevance achieved through imitation learning. However, existing XAI frameworks may require adaptation to MARL, and XAI methodology advantages and constraints must be considered for their utilization. Moreover, we developed a novel XAI technique to generate natural language explanations for MARL systems with symbolic output spaces. Consequentially, we demonstrated that the presented XAI components provide valuable assets in the development process of reliable, trustworthy MARL delivering insights to enhance agents defending cyber critical network infrastructure.
|