Composite Product Cybersecurity Certification Using Explainable AI Based Dynamic Risk Assessment

In the era of security certification, the Composite Target of Evaluation (TOE) plays a key role for composite product cybersecurity certification due to the interconnection among the different hardware and software components. Traditional certification is at odds with time-based sophisticated threats and evolving vulnerabilities. To address this issue, we propose a dynamic risk assessment using Human-in-the-Loop (HITL) reinforcement learning and explainable AI practice to support the composite product cybersecurity certifications. Our approach transforms a composite TOE into individual ones and links assets and vulnerabilities related to the individual TOE for an effective risk assessment through a Deep Q-Network model. The explainable AI practice justifies the model outcomes, while HITL experts validate and refine the decisions to ensure they align with real-world context. In this paper, we evaluated our method using the CVEFree dataset and results showed that the model enhances vulnerability prioritization in total rewards, improving from - 131 to 22,362. Explainable AI aids in the identification of influential features, making the process of issuing a cybersecurity certification more reliable.