[论文解读] Explaining Network Intrusion Detection System Using Explainable AI Framework

Shraddha Mane, Dattaraj Jagdish Rao|arXiv (Cornell University)|Mar 12, 2021

Explainable Artificial Intelligence (XAI)参考文献 6被引用 63

一句话总结

本文为基于深度神经网络的网络入侵检测系统开发了一个可解释的 AI 框架，并在 NSL-KDD 数据集上展示了使用 SHAP、LIME、CoM、ProtoDash 和布尔规则的解释。

ABSTRACT

Cybersecurity is a domain where the data distribution is constantly changing with attackers exploring newer patterns to attack cyber infrastructure. Intrusion detection system is one of the important layers in cyber safety in today's world. Machine learning based network intrusion detection systems started showing effective results in recent years. With deep learning models, detection rates of network intrusion detection system are improved. More accurate the model, more the complexity and hence less the interpretability. Deep neural networks are complex and hard to interpret which makes difficult to use them in production as reasons behind their decisions are unknown. In this paper, we have used deep neural network for network intrusion detection and also proposed explainable AI framework to add transparency at every stage of machine learning pipeline. This is done by leveraging Explainable AI algorithms which focus on making ML models less of black boxes by providing explanations as to why a prediction is made. Explanations give us measurable factors as to what features influence the prediction of a cyberattack and to what degree. These explanations are generated from SHAP, LIME, Contrastive Explanations Method, ProtoDash and Boolean Decision Rules via Column Generation. We apply these approaches to NSL KDD dataset for intrusion detection system and demonstrate results.

研究动机与目标

• 鉴于数据分布的变化和攻击模式的演变，激励在基于 ML 的入侵检测中实现透明度的必要性。
• 提出一个端到端的 Explainable AI 框架，在 ML 流程的每个阶段提供解释。
• 应用多种 XAI 技术揭示特征影响力及预测背后的推理。
• 在 NSL-KDD 入侵检测数据集上演示该方法。

提出的方法

• 训练一个用于网络入侵检测的深度神经网络。
• 整合多种 XAI 方法（SHAP、LIME、对比性解释方法 Contrastive Explanations Method、ProtoDash，以及通过列生成的布尔决策规则）以生成解释。
• 提供能够量化特征影响力及预测推理的解释。
• 将解释应用于 NSL-KDD 数据集，以说明决策的透明性。

实验结果

研究问题

• RQ1 在基于深度学习的入侵检测管道的每个阶段如何生成解释？
• RQ2 根据不同的可解释 AI 方法，哪些特征对入侵预测影响最大？
• RQ3 XAI 的解释是否有助于理解并增强对 NSL-KDD 数据上 IDS 决策的信任？

主要发现

• 提出了一个可解释 AI 框架，以为基于深度神经网络的 IDS 增加透明度。
• 解释使用 SHAP、LIME、Contrastive Explanations Method、ProtoDash 和布尔规则生成。
• 该框架能够衡量哪些特征影响预测以及影响程度。
• 使用 NSL-KDD 数据集来展示该方法的解释能力。