Robust Network Intrusion Detection Through Explainable Artificial Intelligence (XAI)
Pieter Barnard, Nicola Marchetti, Luiz A. DaSilva
Abstract
In this letter, we present a two-stage pipeline for robust network intrusion detection. First, we implement an extreme gradient boosting (XGBoost) model to perform supervised intrusion detection, and leverage the SHapley Additive exPlanation (SHAP) framework to devise explanations of our model. In the second stage, we use these explanations to train an auto-encoder to distinguish between previously seen and unseen attacks. Experiments conducted on the NSL-KDD dataset show that our solution is able to accurately detect new attacks encountered during testing, while its overall performance is comparable to numerous state-of-the-art works from the cybersecurity literature.
Topics & Concepts
Intrusion detection systemComputer scienceLeverage (statistics)Artificial intelligencePipeline (software)Machine learningBoosting (machine learning)Gradient boostingIntrusionData miningGeochemistryRandom forestGeologyProgramming languageNetwork Security and Intrusion DetectionAnomaly Detection Techniques and ApplicationsInternet Traffic Analysis and Secure E-voting