Enhancing Explainability of Machine Learning-based Intrusion Detection Systems

Over the past decade, the anomaly-based Intrusion Detection System (IDS) has established itself with many studies proving its effectiveness, especially with deep learning models. However, these models have become more complex, thus making them difficult for humans to explain the system's decisions. Meanwhile, research to increase the transparency of IDSs receives insufficient attention from the research community. Therefore, this study proposes an Explainable NIDS capable of accurately detecting attacks and providing explicit explanations for its decisions. Our proposed IDS employs the Shapley Additive exPlanations (SHAP) framework to account for IDS decisions. It assists our IDS in self-explain its decisions at both the local and global levels. The local explanation explains the IDS decisions for each specific sample, while the global level provides the feature's importance and shows the attacks' characteristics. To demonstrate the effectiveness, we evaluate our proposal on two well-known IDS datasets: KDD Cup 99 and CICIDS2017. In addition, we experiment with interpreting not only the machine learning model but also the deep learning model. This research is expected to enhance the transparency of anomaly-based IDS and provide deeper insights for security experts.