ATHEA: An Explainable AI Framework for Unsupervised APT Detection in Windows Event Logs

The increasing complexity and sophistication of the APTs (Advanced Persistent Threats), with the use of their blending in with the benign and normal administrative activity techniques, traditional signature-based detection system has been proved to be insufficient. While Windows Event Logs (EVTX) provides a rich and highly detailed source for endpoint analysis, their sheer volume, complexity and the inherent noise make it hard to analyse it manually. We present in this paper, ATHEA, end-to-end unsupervised learning framework designed to not only detect security vulnerabilities and events in EVTX logs, but also to provide deep, easy and human-readable explanations. The system attempts to combine a robust detection pipeline, which starts with the parsing of the EVTX log files, then it proceeds to an extensive feature engineering (extracting over 50 time-based, statistical, and security-specific features). The detection part is handed over to a hybrid unsupervised model (combining Isolation Forest (IF) and Local Outlier Factor (LOF)) to effectively identify both global and local outliers without relying on the pre-labelled datasets. The key contributing factor of this work is its explainability (XAI) framework, which is designed explicitly to address the huge problem in the current Security and ML relationship, that being the “black box” nature of the AI when it come up to certain decisions. The first layer utilizes SHAP (SHapley Additive exPlanations) in order to provide effective, quantitative feature-level contribution analysis, identifying which feature is more responsible for the event to be flagged as anomaly than rest of the other features. This then goes through the second layer, which leverages Google Gemini AI (for now) to deconstruct all the technical aspects of the event and to construct a human-readable and understandable report with all of the context in place, providing the natural-language threat analysis to the analyst. To further harden the claims and analysis, the system automatically contextualizes detected anomalies by mapping them to the MITRE ATT&CK framework and leverages a built-in knowledge base of over 500 critical EventIDs for dynamic, context-aware risk scoring. The purpose of ATHEA Is to bridge the gap between raw, black-boxed anomalies alerts and actionable, easily interpretable events/ alerts as a result empowering security analysis and analysts to detect and respond to the APTs more effectively.