An trustworthy intrusion detection framework enabled by ex-post-interpretation-enabled approach. (December 2022)

• Record Type: Journal Article
• Authors: Peng, Junfeng; Cai, Ziwei; Chen, Zhenyu; Liu, Xujiang; Zheng, Mianyu; Song, Chufeng; Zhu, Xiongyong; Teng, Yi; Zhang, Ruilin; Zhou, Yanqin; Lv, Xuyang; Xu, Jun
• Is Part Of: Journal of information security and applications. Volume 71(2023)
• Publication Date: 2022-12
• Subjects: Intrusion detection -- Machine learning -- Model interpretation -- Contrast method; Computer security -- Periodicals; Information technology -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.jisa.2022.103364
• Languages: English
• ISSNs: 2214-2126

Abstract

Abstract: An enormous number of machine learning models have been recently proposed for intrusion detection. Among these models, the complex models stand out as a prominent approach for intrusion detection in network security. In contrast with the simple models, the complex models are powerful in that it learns the complex abstraction between input and output under the premise of the loss of the transparency. This lack of interpretability hinders the landing of the complex model in the field of intrusion detection. To balance the model interpretability and performance, a novel trustworthy intrusion detection framework (TIDF) combining machine learning and ex-post-interpretation method is proposed in this paper. The proposed framework TIDF achieves 82% prediction accuracy. In the contrast experiment, TIDF outperforms the junior Network Security Manages Engineer (NSME). With the proposed framework, we achieve a good prediction performance and improve the model interpretability in the intrusion detection. Thus, the proposed framework may act as a potential useful tool in the intrusion detection system.