Explainable machine learning in cybersecurity: A survey
Feixue Yan, Sheng Wen, Surya Nepal, Cécile Paris, Yang Xiang
Abstract
Machine learning (ML) techniques are becoming more and more important in cybersecurity, as they can quickly analyse and identify different types of threats from millions of events. In spite of the increasing number of possible applications of machine learning, successful adoption of ML models in cybersecurity still highly relies on the explainability of those models that are used for making predictions. Explanations that support ML model outputs are crucial in cybersecurityoriented ML applications because people need to get more information from the model than just binary output for analysis. Explainable models help ML developers solve the "trust" problem for security application predictions by validating model behaviours, diagnosing misclassifications and sometimes automatically patching errors in the target models. Therefore, explainable ML for cybersecurity has become a necessary and important research branch. In this survey, we present the topic of explainable ML in cybersecurity through two general types of explanations: (1) ante hoc explanation, and (2) post hoc explanation, with their methodologies. Specificallly, we systematically review and categorise the state-of-the-art research, and provide