Scholarlink

Intrusion Detection Systems (IDS) must balance accuracy with interpretability, yet existing approaches often sacrifice one for the other. Classical machine learning methods such as Logistic Regression and Random Forest provide solid accuracy but limited transparency, while deep learning models like CNNs act as black boxes. This paper evaluates TabNet, a deep neural architecture designed for tabular data, as a candidate for IDS. TabNet leverages sequential attention and sparse feature selection, enabling both high performance and feature-level interpretability. We test TabNet on UNSW-NB15, BoT-IoT, and KDD CUP and compare it with Logistic Regression, Random Forest, SVM, and Naïve Bayes. Results show that TabNet achieves near-perfect detection on BoT-IoT (99.98%) and KDD (99.98%), while remaining highly competitive on UNSW-NB15 (99.30%). Its attention masks highlight meaningful features such as flow duration and packet rate, providing actionable insights for analysts. TabNet thus offers a practical trade-off between accuracy and explainability, making it well-suited for next-generation IDS.

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

TabNet for Intrusion Detection: Bridging Accuracy and Interpretability in Tabular Network Data

  • 会议论文

  • 发表日期：

    2026年

查看全文
  • Joideep Banerjee,
  • Asma Patel

摘要

Intrusion Detection Systems (IDS) must balance accuracy with interpretability, yet existing approaches often sacrifice one for the other. Classical machine learning methods such as Logistic Regression and Random Forest provide solid accuracy but limited transparency, while deep learning models like CNNs act as black boxes. This paper evaluates TabNet, a deep neural architecture designed for tabular data, as a candidate for IDS. TabNet leverages sequential attention and sparse feature selection, enabling both high performance and feature-level interpretability. We test TabNet on UNSW-NB15, BoT-IoT, and KDD CUP and compare it with Logistic Regression, Random Forest, SVM, and Naïve Bayes. Results show that TabNet achieves near-perfect detection on BoT-IoT (99.98%) and KDD (99.98%), while remaining highly competitive on UNSW-NB15 (99.30%). Its attention masks highlight meaningful features such as flow duration and packet rate, providing actionable insights for analysts. TabNet thus offers a practical trade-off between accuracy and explainability, making it well-suited for next-generation IDS.