Automated AI model-based pipeline for detection explainability

1 . A method, comprising:

obtaining, from a user device, a ticket comprising computer-readable text and an indication of a false positive detection of malicious behavior with respect to the computer-readable text by a cybersecurity system, wherein the cybersecurity system prevents the user device from performing an action based on the false positive detection;

generating a plurality of job requests, wherein the plurality of job requests includes a job request comprising the computer-readable text and the indication of the false positive detection;

generating a schedule for the plurality of job requests including the job request;

allocating resources for the job request based on the schedule;

obtaining, by a processing device and via an artificial intelligence (AI) model trained to generate language, a reason for the false positive detection of the malicious behavior based on the allocated resources;

validating the reason for the false positive detection by determining an absence of a hallucination of the AI model in the reason for the false positive detection;

providing an indication of the reason for the false positive detection to a destination device; and

deallocating the allocated resources subsequent to providing the indication of the reason for the false positive detection.

2 . The method of claim 1 , wherein the destination device is the user device, wherein obtaining the computer-readable text and the indication of the false positive detection of the malicious behavior comprises receiving, from the user device and by way of a network, the computer-readable text and the indication of the false positive detection of the malicious behavior, and wherein providing the indication of the reason comprises transmitting to the user device and by way of the network, the indication of the reason.

3 . The method of claim 1 , wherein the cybersecurity system comprises a machine learning model trained to detect the malicious behavior, the method further comprising:

identifying a type of the malicious behavior based on at least one of the computer-readable text or the indication of the false positive detection;

obtaining additional training data corresponding to the type of the malicious behavior; and

modifying at least one parameter of the machine learning model based on the additional training data.

4 . The method of claim 1 , further comprising:

modifying at least one parameter of a malware detection mechanism of the cybersecurity system based on the reason for the false positive detection.

5 . The method of claim 1 , wherein the destination device comprises the user device, the method further comprising:

populating a template with the reason for the false positive detection, wherein providing the indication of the reason for the false positive detection comprises transmitting the populated template to the user device.

6 . The method of claim 1 , wherein the indication of the reason for the false positive detection comprises at least one of:

an indication of assessment of a maliciousness of the computer-readable text,

a first indication of the reason for the false positive detection, or

an indication of a portion of the computer-readable text which caused the false positive detection.

7 . The method of claim 1 , wherein the AI model is hosted at a cloud device, and wherein obtaining the reason for the false positive detection of the malicious behavior comprises:

transmitting, to the cloud device, a request comprising the computer-readable text and the indication of the false positive detection of the malicious behavior; and

receiving, from the cloud device and based on the request, the reason for the false positive detection of the malicious behavior.

8 . The method of claim 1 , wherein obtaining the reason for the false positive detection of the malicious behavior comprises:

providing the computer-readable text and the indication of the false positive detection of the malicious behavior as input to the AI model; and

obtaining the reason for the false positive detection of the malicious behavior as an output of the AI model.

9 . The method of claim 1 , wherein the computer-readable text comprises at least one of an email, a script, a uniform resource locator (URL), a text message, a team communication platform message, or source code.

10 . The method of claim 1 , wherein the computer-readable text comprises a first portion related to the false positive detection and a second portion unrelated to the false positive detection, wherein the indication of the reason for the false positive detection comprises the first portion, the method further comprising:

modify at least one parameter of an explainability agent based on the first portion of the computer-readable text.

11 . The method of claim 1 , further comprising:

receiving feedback from the destination device based on the indication of the reason for the false positive detection; and

modifying at least one parameter of the AI model based on the feedback.

12 . A system, comprising:

a memory; and

a processing device, operatively coupled to the memory, to:

obtain, from a user device, a ticket comprising computer-readable text and an indication of a false positive detection of malicious behavior with respect to the computer-readable text by a cybersecurity system, wherein the cybersecurity system prevents the user device from performing an action based on the false positive detection;

generate a plurality of job requests, wherein the plurality of job requests includes a job request comprising the computer-readable text and the indication of the false positive detection;

generate a schedule for the plurality of job requests including the job request;

allocate resources for the job request based on the schedule;

obtain, via an artificial intelligence (AI) model trained to generate language, a reason for the false positive detection of the malicious behavior based on the allocated resources;

validate the reason for the false positive detection by determining an absence of a hallucination of the AI model in the reason for the false positive detection;

provide an indication of the reason for the false positive detection to a destination device; and

deallocate the allocated resources subsequent to providing the indication of the reason for the false positive detection.

13 . The system of claim 12 , wherein the destination device is the user device, wherein to obtain the computer-readable text and the indication of the false positive detection of the malicious behavior, the processing device is to receive, from the user device and by way of a network, the computer-readable text and the indication of the false positive detection of the malicious behavior, and wherein to provide the indication of the reason, the processing device is to transmit, to the user device and by way of the network, the indication of the reason.

14 . The system of claim 12 , wherein the cybersecurity system comprises a machine learning model trained to detect the malicious behavior, and wherein the processing device is further to:

identify a type of the malicious behavior based on at least one of the computer-readable text or the indication of the false positive detection;

obtain additional training data corresponding to the type of the malicious behavior; and

modify at least one parameter of the machine learning model based on the additional training data.

15 . A non-transitory computer readable medium, having instructions stored thereon which, when executed by a processing device, cause the processing device to:

obtain, from a user device, a ticket comprising computer-readable text and an indication of a false positive detection of malicious behavior with respect to the computer-readable text by a cybersecurity system, wherein the cybersecurity system prevents the user device from performing an action based on the false positive detection;

generate a plurality of job requests, wherein the plurality of job requests includes a job request comprising the computer-readable text and the indication of the false positive detection;

generate a schedule for the plurality of job requests including the job request;

allocate resources for the job request based on the schedule;

obtain, by the processing device and via an artificial intelligence (AI) model trained to generate language, a reason for the false positive detection of the malicious behavior based on the allocated resources;

validate the reason for the false positive detection by determining an absence of a hallucination of the AI model in the reason for the false positive detection;

provide an indication of the reason for the false positive detection to a destination device; and

deallocate the allocated resources subsequent to providing the indication of the reason for the false positive detection.

16 . The non-transitory computer readable medium of claim 15 , wherein the destination device is the user device, wherein to obtain the computer-readable text and the indication of the false positive detection of the malicious behavior, the instructions, when executed by the processing device, cause the processing device to receive, from the user device and by way of a network, the computer-readable text and the indication of the false positive detection of the malicious behavior, and wherein to provide the indication of the reason, the instructions, when executed by the processing device, cause the processing device to transmit, to the user device and by way of the network, the indication of the reason.

17 . The non-transitory computer readable medium of claim 15 , wherein the cybersecurity system comprises a machine learning model trained to detect the malicious behavior, and wherein the instructions, when executed by the processing device, cause the processing device further to:

identify a type of the malicious behavior based on at least one of the computer-readable text or the indication of the false positive detection;

obtain additional training data corresponding to the type of the malicious behavior; and

modify at least one parameter of the machine learning model based on the additional training data.

18 . The system of claim 12 , wherein the computer-readable text comprises at least one of an email, a script, a uniform resource locator (URL), a text message, a team communication platform message, or source code.

19 . The non-transitory computer readable medium of claim 15 , wherein the computer-readable text comprises at least one of an email, a script, a uniform resource locator (URL), a text message, a team communication platform message, or source code.

20 . The system of claim 12 , wherein the processing device is further to:

receive feedback from the destination device based on the indication of the reason for the false positive detection; and

modify at least one parameter of the AI model based on the feedback.