CyTReX turns DNP3 anomaly alerts into traceable ranked threat hypotheses, with a five-configuration comparison showing the complete pipeline gives the richest evidence but weaker label anchoring
The paper presents CyTReX, an explainable threat reasoning framework for distributed energy resource (DER) networks that consolidates edge anomaly detection evidence, cloud attack interpretation, SHAP feature attributions, surrogate decision rules, and MCP-enabled cyber threat intelligence into a unified evidence packet that constrains large language model reasoning to produce ranked threat hypotheses and attack trees; across five configurations on a DNP3 case study, adding reasoning components improved hypothesis specificity, evidence traceability, and analytical grounding, with the complete pipeline providing the richest evidence-grounded reasoning context.