Use Cases and Design of an Intelligent Intrusion Detection System

Roponena, Evita; Kampars, Jānis; Grabis, Jānis; Mosāns, Guntis

doi:10.22364/bjmc.2022.10.4.06

Cited by 3 publications

(6 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In this context, several recent works have begun exploring the utilization of Explainable Artificial Intelligence (XAI) for intrusion detection systems (IDS) [16]- [19]. For instance, [16] employed decision tree algorithms to extract rules in IDS using the NSL-KDD dataset.…”

Section: Related Workmentioning

confidence: 99%

“…There are several recent works that started exploring leveraging XAI for IDS (e.g., [16]- [20]). The work [19] proposed an abstract design for a human-in-the-loop approach for intelligent IDS. Moreover, the work [16] used only a simple decision tree algorithm for extracting decision rules using exclusively the NSL-KDD benchmark dataset [21].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

E-XAI: Evaluating Black-Box Explainable AI Frameworks for Network Intrusion Detection

Arreche,

Guntur,

Roberts

et al. 2024

IEEE Access

View full text Add to dashboard Cite

The exponential growth of intrusions on networked systems inspires new research directions on developing artificial intelligence (AI) techniques for intrusion detection systems (IDS). In particular, the need to understand and explain these AI models to security analysts (managing these IDS to safeguard their networks) motivates the usage of explainable AI (XAI) methods in real-world IDS. In this work, we propose an end-to-end framework to evaluate black-box XAI methods for network IDS. We evaluate both global and local scopes for these black-box XAI methods for network intrusion detection. We analyze six different evaluation metrics for two popular black-box XAI techniques, namely SHAP and LIME. These metrics are descriptive accuracy, sparsity, stability, efficiency, robustness, and completeness. They cover main metrics from network security and AI domains. We evaluate our XAI evaluation framework using three popular network intrusion datasets and seven AI methods with different characteristics. We release our codes for the network security community to access it as a baseline XAI framework for network IDS. Our framework shows the limitations and strengths of current black-box XAI methods when applied to network IDS.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

E-XAI: Evaluating Black-Box Explainable AI Frameworks for Network Intrusion Detection

Arreche,

Guntur,

Roberts

et al. 2024

IEEE Access

View full text Add to dashboard Cite

show abstract

“…Several recent studies have explored the application of XAI techniques in IDSs [72][73][74][75]. For example, ref.…”

Section: Related Workmentioning

confidence: 99%

XAI-IDS: Toward Proposing an Explainable Artificial Intelligence Framework for Enhancing Network Intrusion Detection Systems

Arreche,

Guntur,

Abdallah

2024

Applied Sciences

View full text Add to dashboard Cite

The exponential growth of network intrusions necessitates the development of advanced artificial intelligence (AI) techniques for intrusion detection systems (IDSs). However, the reliance on AI for IDSs presents several challenges, including the performance variability of different AI models and the opacity of their decision-making processes, hindering comprehension by human security analysts. In response, we propose an end-to-end explainable AI (XAI) framework tailored to enhance the interpretability of AI models in network intrusion detection tasks. Our framework commences with benchmarking seven black-box AI models across three real-world network intrusion datasets, each characterized by distinct features and challenges. Subsequently, we leverage various XAI models to generate both local and global explanations, shedding light on the underlying rationale behind the AI models’ decisions. Furthermore, we employ feature extraction techniques to discern crucial model-specific and intrusion-specific features, aiding in understanding the discriminative factors influencing the detection outcomes. Additionally, our framework identifies overlapping and significant features that impact multiple AI models, providing insights into common patterns across different detection approaches. Notably, we demonstrate that the computational overhead incurred by generating XAI explanations is minimal for most AI models, ensuring practical applicability in real-time scenarios. By offering multi-faceted explanations, our framework equips security analysts with actionable insights to make informed decisions for threat detection and mitigation. To facilitate widespread adoption and further research, we have made our source code publicly available, serving as a foundational XAI framework for IDSs within the research community.

show abstract

Section: Introductionmentioning

confidence: 99%

“…The use of explainable AI (XAI) in IDS has been the subject of several recent studies [51,66,37,70]. A specific study [70] presented an abstract idea for an intelligent IDS method that involves the human in the loop. Furthermore, another study that only looked at the NSL-KDD benchmark dataset [21] extracted decision rules using a straightforward decision tree algorithm [51].…”

Section: Introductionmentioning

confidence: 99%

Let us Unveil Network Intrusion Features: Enhancing Network Intrusion Detection Systems via XAI-based Feature Selection

Arreche,

Guntur,

Abdallah

2024

Preprint

View full text Add to dashboard Cite

Explainability and evaluation of AI models are crucial parts of the security of modern intrusion detection systems (IDS) in the network security field, yet they are lacking. Accordingly, feature selection is essential for such parts in IDS because it identifies the most paramount features, enhancing attack detection and its description. In this work, we tackle feature selection problem for IDS via suggesting new ways of applying eXplainable AI (XAI) methods for this problem. We identify the crucial attributes originated by distinct AI methods in tandem with novel five attribute selection methods. We then compare many state-of-the-art feature selection strategies with our XAI-based feature selection methods, showing that most AI models perform better when using the XAI-based approach proposed in this work. By providing novel feature selection techniques and establishing the foundation for several XAIbased strategies, this research aids security analysts in the AI decision-making reasoning of IDS by providing them with a better grasp of critical intrusion traits. Furthermore, we make the source codes available, thus the community may develop additional models on top of our foundational XAI-based feature selection framework.

show abstract

Use Cases and Design of an Intelligent Intrusion Detection System

Cited by 3 publications

References 0 publications

E-XAI: Evaluating Black-Box Explainable AI Frameworks for Network Intrusion Detection

E-XAI: Evaluating Black-Box Explainable AI Frameworks for Network Intrusion Detection

XAI-IDS: Toward Proposing an Explainable Artificial Intelligence Framework for Enhancing Network Intrusion Detection Systems

Let us Unveil Network Intrusion Features: Enhancing Network Intrusion Detection Systems via XAI-based Feature Selection

Contact Info

Product

Resources

About