Enhancing explainability of machine learning-based intrusion detection systems

Abstract

Over the past decade, the anomaly-based Intrusion Detection System (IDS) has established itself with many studies proving its effectiveness, especially with deep learning models. However, these models have become more complex, thus making them difficult for humans to explain the system’s decisions. Meanwhile, research to increase the transparency of IDSs receives insufficient attention from the research community. Therefore, this study proposes an Explainable NIDS capable of accurately detecting attacks and providing explicit explanations for its decisions. Our proposed IDS employs the Shapley Additive exPlanations (SHAP) framework to account for IDS decisions. It assists our IDS in self-explain its decisions at both the local and global levels. The local explanation explains the IDS decisions for each specific sample, while the global level provides the feature’s importance and shows the attacks’ …