.png){kind=icon}
返回
An Explainable Machine Learning Framework for Intrusion Detection Systems
.png){kind=icon}
OA
AI
DOI：10.1109/ACCESS.2020.2988359.png)
.png){kind=icon}
.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
In recent years, machine learning-based intrusion detection systems (IDSs) have proven to be effective; especially, deep neural networks improve the detection rates of intrusion detection models. However, as models become more and more complex, people can hardly get the explanations behind their decisions. At the same time, most of the works about model interpretation focuses on other fields like computer vision, natural language processing, and biology. This leads to the fact that in practical use, cybersecurity experts can hardly optimize their decisions according to the judgments of the model. To solve these issues, a framework is proposed in this paper to give an explanation for IDSs. This framework uses SHapley Additive exPlanations (SHAP), and combines local and global explanations to improve the interpretation of IDSs. The local explanations give the reasons why the model makes certain decisions on the specific input. The global explanations give the important features extracted from IDSs, present the relationships between the feature values and different types of attacks. At the same time, the interpretations between two different classifiers, one-vs-all classifier and multiclass classifier, are compared. NSL-KDD dataset is used to test the feasibility of the framework. The framework proposed in this paper leads to improve the transparency of any IDS, and helps the cybersecurity staff have a better understanding of IDSs & x2019; judgments. Furthermore, the different interpretations between different kinds of classifiers can also help security experts better design the structures of the IDSs. More importantly, this work is unique in the intrusion detection field, presenting the first use of the SHAP method to give explanations for IDSs.
Keyword:
Intrusion detection
Computational modeling
Predictive models
Machine learning
Biological system modeling
Feature extraction
Intrusion detection system
Shapley value
SHapley Additive exPlanations
model interpretation
machine learning
AI总结
对已上传原文的论文进行重点信息的提取，主要内容包括：简要概述、研究摘要、背景介绍、关键亮点、图文解析、展望与总结。
期刊
IF:
3.6
论文数:
9.8W
被引数:
29.4W
机构
引用论文
From Intrusion Detection to Attacker Attribution: A Comprehensive Survey of Unsupervised Methods从入侵检测到攻击者归因: 无监督方法的综合考察OAAI
OAAI分享收藏分享收藏Uncoupled 6-core Fibers with a Standard 125-m Cladding, ITU-T G.652 Optical Properties, and Low XT
PREAI
分享收藏Deep Learning Approach for Intelligent Intrusion Detection System面向智能入侵检测系统的深度学习方法.png)
IEEE ACCESSOAAI
IEEE ACCESSIF3.6
OAAI分享收藏
查看更多内容