An explainable intrusion detection system based on feature importance

The rapid expansion of the Internet has boosted the widespread adoption of cloud technology across data-center fabrics and generated massive traffic. The emerging intrusion traffic brings new challenges to network security. Despite the remarkable advancements made by deep learning (DL) in fields including computer vision (CV) and natural language processing (NLP), its effectiveness in handling discrete time-series data, particularly in anomaly traffic, remains poor. It also fails to offer interpretability for prediction results, impeding its practicability to guide subsequent steps such as intrusion detection and prevention. This paper presents an interpretable intrusion detection system (IDS) based on feature importance. The approach first extracts significant features by methods including the Principal Component Analysis (PCA) and decision tree (DT). Then it converts important features into 2D feature images so that integrating with existing convolutional neural networks (CNNs) for predictions. Comparative experiments with more than 10 existing methods demonstrate this proposed method enhances detection capabilities and enable the intuitive interpretability of the analysis procedure.