Scholarlink

Cyber-physical systems (CPS) increasingly underlie critical infrastructures, and ensuring they remain free of anomalies is paramount, although many existing detection techniques either struggle to adapt to novel threats or offer little insight into how decisions are reached. In this paper, we introduce a convolutional neural network (CNN) combined with SHAP (SHapley Additive exPlanations) that not only achieves an accuracy of 98.89% but also provides transparent justifications for each anomaly prediction. By carefully preprocessing the NSL-KDD dataset—merging and standardizing features, as well as encoding categorical fields—we create a robust foundation for our CNN, which employs one-dimensional convolutions, dropout, and global average pooling to capture subtle patterns while mitigating overfitting risks. Empirical evaluations show that precision, recall, and F1-score all exceed 98%, with the ROC AUC reaching 99.93%, yet the true novelty lies in how SHAP clarifies feature-level contributions, empowering system operators and security professionals to understand precisely why particular instances are flagged as malicious or benign.

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Interpretable Anomaly Detection for Cyber-Physical System Risk Mitigation Using CNN and SHAP

  • 章节

  • 发表日期：

    2026年

查看全文
  • Kamal Bella,
  • Azidine Guezzaz,
  • Ravikumar Patchmuthu,
  • Said Benkirane,
  • Mouaad Mohy-Eddine,
  • Mourade Azrour

摘要

Cyber-physical systems (CPS) increasingly underlie critical infrastructures, and ensuring they remain free of anomalies is paramount, although many existing detection techniques either struggle to adapt to novel threats or offer little insight into how decisions are reached. In this paper, we introduce a convolutional neural network (CNN) combined with SHAP (SHapley Additive exPlanations) that not only achieves an accuracy of 98.89% but also provides transparent justifications for each anomaly prediction. By carefully preprocessing the NSL-KDD dataset—merging and standardizing features, as well as encoding categorical fields—we create a robust foundation for our CNN, which employs one-dimensional convolutions, dropout, and global average pooling to capture subtle patterns while mitigating overfitting risks. Empirical evaluations show that precision, recall, and F1-score all exceed 98%, with the ROC AUC reaching 99.93%, yet the true novelty lies in how SHAP clarifies feature-level contributions, empowering system operators and security professionals to understand precisely why particular instances are flagged as malicious or benign.