Utilizing XAI Technique to Improve Autoencoder based Model for Computer Network Anomaly Detection with Shapley Additive Explanation(SHAP)

Abstract

Machine learning (ML) and Deep Learning (DL) methods are being adopted rapidly, especially in computer network security, such as fraud detection, network anomaly detection, intrusion detection, and much more. However, the lack of transparency of ML and DL based models is a major obstacle to their implementation and criticized due to its black-box nature, even with such tremendous results. Explainable Artificial Intelligence (XAI) is a promising area that can improve the trustworthiness of these models by giving explanations and interpreting its output. If the internal working of the ML and DL based models is understandable, then it can further help to improve its performance. The objective of this paper is to show that how XAI can be used to interpret the results of the DL model, the autoencoder in this case. And, based on the interpretation, we improved its performance for computer network anomaly detection. The kernel SHAP method, which is based on the shapley values, is used as a novel feature selection technique. This method is used to identify only those features that are actually causing the anomalous behaviour of the set of attack/anomaly instances. Later, these feature sets are used to train and validate the autoencoderbut on benign data only. Finally, the built SHAP_Model outperformed the other two models proposed based on the feature selection method. This whole experiment is conducted on the subset of the latest CICIDS2017 network dataset. The overall accuracy and AUC of SHAP_Model is 94% and 0.969, respectively.

AE‐Integrated: Real‐time network intrusion detection with Apache Kafka and autoencoder

“…The proposed solution is simulated with Apache Kafka stream processing API. We extend our previous research work 3,4,26–28 and proposed a scalable and realistic solution with simulation to validate its authenticity.…”

“…The average accuracy achieved by the model is 99.29%. In references 26,27, the concept of Explainable AI 73 is used to improve the performance of the model. The kernelSHAP 74 method is used to select the optimal feature sets that affect the RE, and later same feature sets are used for the model building purpose.…”

Partitioned Problem Space (PaPS) Ensemble For Zero-day Intrusion Detection

“…The classification accuracy of attack labels is 90.01% for DoS (GoldenEye), 98.43% for DoS (Hulk), 98.47% for Port scanning, and 99.67% for DDoS attacks. Autoencoders for detecting anomalies in the network using shapley values were explored by authors in the paper [26] which achieved overall accuracy and F1-score of 94% and 90% respectively. Another paper [1] used two feature dimensionality reduction approaches, one autoencoder-based and one using Principal Component Analysis (PCA [25]).…”

Explainable Artificial Intelligence Applications in Cyber Security: State-of-the-Art in Research

“…XAI methods can also be utilized to improve the performance of the fraud detection models. In [193], Khushnaseeb et al proposed SHAP_Model based on the autoencoder for network fraud detection using SHAP values, implemented in a subset of the CICIDS2017 dataset and achieved overall accuracy and AUC of 94% and 96.9% respectively. The top 30 features with the highest SHAP values, playing a more significant role in causing abnormal behavior in fraud detection than any other features, were employed to build the SHAP_Model.…”