The More, the Better

Drichel, Arthur; Holmes, Benedikt; Brandt, Justus von; Meyer, Ulrike

doi:10.1145/3474374.3486915

Cited by 6 publications

(3 citation statements)

References 31 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Autoencoders. Finally, the proposed approach will be extended to multi-domain infrastructures using Federated Learning [63] for collaborative DGA name detection, similarly to [64], [65]. Therefore, privacy-aware model interpretations will be derived without sharing attack and benign data.…”

Section: Discussionmentioning

confidence: 99%

SHAP Interpretations of Tree and Neural Network DNS Classifiers for Analyzing DGA Family Characteristics

et al. 2023

View full text Add to dashboard Cite

Domain Generation Algorithms (DGA's) have been employed by botnet orchestrators for controlling infected hosts (bots), while evading detection by performing multiple DNS requests, mostly for non-existing domain names. With blacklists ineffective, modern DGA filtering methods rely on Machine Learning (ML). Emerging needs for higher intrusion detection accuracy lead to complex, non-interpretable black-box classifiers, thus requiring eXplainable Artificial Intelligence (XAI) techniques. In this paper, we utilize SHapley Additive exPlanation (SHAP) to derive model-agnostic, post-hoc interpretations on DGA name classifiers. This method is applied to binary supervised tree-based classifiers (e.g. eXtreme Gradient Boosting -XGBoost) and deep neural networks (Multi-Layer Perceptron -MLP) to assess domain name feature importance. SHAP visualization tools (summary, dependence, force plots) are used to rank features, investigate their effect on model decisions and determine their interactions. Specific interpretations are detailed for identifying names belonging to common DGA families pertaining to arithmetic, wordlist, hash and permutation based schemes. Learning and interpretations are based on up-to-date datasets, such as Tranco for benign and DGArchive for malicious names. Domain name features are extracted from dataset instances, thus limiting time-consuming and privacy-invasive database operations on historical data. Our experimental results demonstrate that SHAP enables explanations of XGBoost (the most accurate tree-based model) and MLP classifiers and indicates the characteristics of specific DGA schemes, commonly employed in attacks. In conclusion, we envision that XAI methods will expedite ML deployment in networking environments where justifications for black-box models are required.

show abstract

Section: Discussionmentioning

confidence: 99%

SHAP Interpretations of Tree and Neural Network DNS Classifiers for Analyzing DGA Family Characteristics

et al. 2023

View full text Add to dashboard Cite

show abstract

“…[159], [160], [161], [162], [163], [164], [165], [166], [167], [168], [169], [170] [185], [186], [187], [188], [189], [190], [191], [192], [193], [194], [195], [196], [197], [198], [199], [200] Usability, HCI, and Visualization (3 the latter two fields generally work on other data (often images or text), or focus more on sophisticated methodologies themselves (AI/ML algorithms, visualization techniques, etc.). Only a small fraction of these papers proposes NIDS and utilizes network traffic data.…”

Section: Publication Venuesmentioning

confidence: 99%

The Missing Link in Network Intrusion Detection: Taking AI/ML Research Efforts to Users

Dietz,

Mühlhauser,

Kögel

et al. 2024

IEEE Access

View full text Add to dashboard Cite

Intrusion Detection Systems (IDS) tackle the challenging task of detecting network attacks as fast as possible. As this is getting more complex in modern enterprise networks, Artificial Intelligence (AI) and Machine Learning (ML) have gained substantial popularity in research. However, their adoption into real-world IDS solutions remains poor. Academic research often overlooks the interconnection of users and technical aspects. This leads to less explainable AI/ML models that hinder trust among AI/ML non-experts. Additionally, research often neglects secondary concerns such as usability and privacy. If IDS approaches conflict with current regulations or if administrators cannot deal with attacks more effectively, enterprises will not adopt the IDS in practice. To identify those problems systematically, our literature survey takes a user-centric approach; we examine IDS research from the perspective of stakeholders by applying the concept of personas. Further, we investigate multiple factors limiting the adoption of AI/ML in security and suggest technical, non-technical, and user-related considerations to enhance the adoption in practice. Our key contributions are threefold. (i) We derive personas from realistic enterprise scenarios, (ii) we provide a set of relevant hypotheses in the form of a review template, and (iii), based on our reviews, we derive design guidelines for practical implementations. To the best of our knowledge, this is the first paper that analyzes practical adoption barriers of AI/ML-based intrusion detection solutions concerning appropriateness of data, reproducibility, explainability, practicability, usability, and privacy. Our guidelines may help researchers to holistically evaluate their AI/ML-based IDS approaches to increase practical adoption.

show abstract

“…The need for using multiple data sources for training AI models while complying with data protection regulations encourages the adoption of collaborative learning (CL) strategies, in which the exchange of sensitive information is minimized. CL can be defined as a machine learning paradigm in which different entities can collaborate and jointly perform an analytical task without the need for sharing the original data [12, 17, 18]. To this end, CL relies on the sharing of data abstractions, which can, for instance, take the form of model parameters, global statistics, or predictions.…”

Section: Introductionmentioning

confidence: 99%

A cautionary tale on the cost-effectiveness of collaborative AI in real-world medical applications

Innocenti,

Ourselin,

Goh

et al. 2024

Preprint

View full text Add to dashboard Cite

Federated learning (FL) has gained wide popularity as a collaborative learning paradigm enabling trustworthy AI in sensitive healthcare applications. Never-theless, the practical implementation of FL presents technical and organizational challenges, as it generally requires complex communication infrastructures. In this context, consensus-based learning (CBL) may represent a promising collaborative learning alternative, thanks to the ability of combining local knowledge into a federated decision system, while potentially reducing deployment over-head. In this work we propose an extensive benchmark of the accuracy and cost-effectiveness of a panel of FL and CBL methods in a wide range of collaborative medical data analysis scenarios. Our results reveal that CBL is a cost-effective alternative to FL, providing comparable accuracy and significantly reducing training and communication costs. This study opens a novel perspective on the deployment of collaborative AI in real-world applications, whereas the adoption of cost-effective methods is instrumental to achieve sustainability and democratisation of AI by alleviating the need for extensive computational resources.

show abstract

The More, the Better

Cited by 6 publications

References 31 publications

SHAP Interpretations of Tree and Neural Network DNS Classifiers for Analyzing DGA Family Characteristics

SHAP Interpretations of Tree and Neural Network DNS Classifiers for Analyzing DGA Family Characteristics

The Missing Link in Network Intrusion Detection: Taking AI/ML Research Efforts to Users

A cautionary tale on the cost-effectiveness of collaborative AI in real-world medical applications

Contact Info

Product

Resources

About