Explainable AI and Random Forest Based Reliable Intrusion Detection system

Abstract

<p>Emerging Cyber threats with an increased dependency on vulnerable cyber-networks have jeopardized all stakeholders, making Intrusion Detection Systems (IDS) the essential network security requirement. Several IDS have been proposed in the past decade for preventing systems from cyber-attacks. Machine learning (ML) based IDS have shown remarkable performance on conventional cyber threats. However, the introduction of adversarial attacks in the cyber domain highlights the need to upgrade these IDS because conventional ML-based approaches are vulnerable to adversarial attacks. Therefore, the proposed IDS framework leverages the performance of conventional ML-based IDS and integrates it with Explainable AI (XAI) to deal with adversarial attacks. Global Explanation of AI model, extracted by SHAP (Shapley additive explanation) during the training phase of Primary Random Forest Classifier (RFC), is used to reassess the credibility of predicted outcomes. In other words, an outcome with low credibility is reassessed by secondary classifiers. This SHAP-based approach helps in filtering out all disguised malicious network traffic and can also enhance user trust by adding transparency to the decision-making process. Adversarial robustness of the proposed IDS was assessed by Hop Skip Jump Attack and CICIDS dataset, where IDS showed 98.5% and 100% accuracy, respectively. Furthermore, the performance of the proposed IDS is compared with conventional algorithms using recall, precision, accuracy, and F1-score as evaluation metrics. This comparative analysis and series of experiments endorse the credibility of the proposed scheme, depicting that the integration of XAI with conventional IDS can ensure credibility, integrity, and availability of cyber-networks.</p>

Explainable Artificial Intelligence in CyberSecurity: A Survey

“…At the local level, they use a Decision Plot to explain decisions on individual instances of the datasets. Another similar work is the framework proposed by [94], consisting of a Random Forest model using SHAP. The model can assess the credibility of the predicted results and ensure a high level of accuracy in detecting modern Cyber threats.…”

Explainable Artificial Intelligence Applications in Cyber Security: State-of-the-Art in Research

“…Syed et al [213] suggested an Intrusion Detection System that used the global explanations created by the SHAP and Random Forest joint framework to detect all forms of malicious intrusion in network traffic. The suggested framework was composed of 2 stages of Random Forest classifiers and one SHAP stage.…”

Explainable artificial intelligence for cybersecurity: a literature survey

“…Anomaly detection. Khan et al [131] leveraged global explanation on Tree-SHAP to correlate an RF decision for explainable IDS. Their explainable IDS architecture comprised three main modules: (1) RF classifier (RFC) module for security predictions; (2) SHAP module extracting values relative to each feature of the dataset, and representing the importance of each feature in the decision made by the RFC; (3) Credibility assessment module (CAM), which utilizes the prediction and Shapley values to evaluate the confidence of prediction made by the RFC.…”