The rise of cyber threats makes Intrusion Dectection Systems (IDS) essential for network security. With the development of machine learning, these IDS have been significantly improved even if the trade-off between performance and interpretability remains an issue. In recent years, several authors have proposed white-box IDS systems to enhance trust and confidence of security analysts. However, only few of these works provide a systematic evaluation of the proposed explainable AI (XAI) techniques. In this paper, we propose a thorough analysis of LIME and SHAP explainers on a high performance ensemble-based IDS. The proposed IDS is trained on the publicly available datasets Edge-IIoTset, N-BaIot and CIC-IDS2017 with AGRU and XGBoost, and the results show that XGBoost classifies better with an accuracy of 1 on two datasets compared to 0.99 for AGRU. We then assessed the performance of the explainers under three metrics (stability, fidelity and sparsity) on XGBoost predictions. The results revealed that SHAP was more stable (stability \(>80\%\) ) for various noise values in the feature values and more faithful (Fid+ \(>60\%\) ) on N-BaIoT dataset, while it achieved the highest sparsity for the classes of the CIC-IDS2017 dataset.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Enhancing the Assessment of the Quality of Explanations for AI-Based Network IDS

  • Audrey Fongue,
  • Jerry Lonlac,
  • Patrick Sondi,
  • Ahmed Meddahi

摘要

The rise of cyber threats makes Intrusion Dectection Systems (IDS) essential for network security. With the development of machine learning, these IDS have been significantly improved even if the trade-off between performance and interpretability remains an issue. In recent years, several authors have proposed white-box IDS systems to enhance trust and confidence of security analysts. However, only few of these works provide a systematic evaluation of the proposed explainable AI (XAI) techniques. In this paper, we propose a thorough analysis of LIME and SHAP explainers on a high performance ensemble-based IDS. The proposed IDS is trained on the publicly available datasets Edge-IIoTset, N-BaIot and CIC-IDS2017 with AGRU and XGBoost, and the results show that XGBoost classifies better with an accuracy of 1 on two datasets compared to 0.99 for AGRU. We then assessed the performance of the explainers under three metrics (stability, fidelity and sparsity) on XGBoost predictions. The results revealed that SHAP was more stable (stability \(>80\%\) ) for various noise values in the feature values and more faithful (Fid+ \(>60\%\) ) on N-BaIoT dataset, while it achieved the highest sparsity for the classes of the CIC-IDS2017 dataset.