Separating prediction and explanation: anapproach based on Explainable ArtificialIntelligence for analyzing network intrusions

Abstract Intrusion detection maintains the normal activity of the network system by identifying abnormal connections, while intrusion analysis further identifies specific types of abnormality. The current intrusion detection systems (IDSs) have connected intrusion detection, intrusion analysis, and intrusion processing in series so that the system can address network intrusion behaviors of attackers promptly. Most IDSs are constructed with complex models to achieve high-precision intrusion detection and intrusion analysis tasks. The generation of Explainable Artificial Intelligence (XAI) helps to aid in understanding the decision logic of the prediction of IDS for unknown data. It also helps to establish a plausible criterion for further categorized predictions of the type of abnormal data. With this in mind, this paper proposes an XAI-based approach for analyzing network intrusion by the contribution of features of data to prediction results. The Shapely values are used to represent these contributions and are derived from SHapley Additive exPlanations (SHAP). Specific classification criterion is extracted from these contributions for analyzing unknown types of abnormal data. We conducted experiments on seven publicly available intrusion detection datasets. The experimental results have shown that the approach can realize the effective analysis of abnormal data while ensuring high-accuracy detection of network intrusion data. At the same time, when compared to autoencode and decision tree (DT) which with both prediction and explanation, the proposed approach can get a better overall performance in intrusion detection and intrusion analysis tasks.