PROJECT TITLE :

An Explainable Machine Learning Framework for Intrusion Detection Systems

ABSTRACT:

Machine learning-based intrusion detection systems (IDSs) have proven to be useful in recent years; in particular, deep neural networks enhance intrusion detection model detection rates. People, on the other hand, are finding it increasingly difficult to understand the reasoning behind their decisions as models become more sophisticated. Simultaneously, the majority of model interpretation research focuses on other domains such as computer vision, natural language processing, and biology. As a result, cybersecurity specialists will find it difficult to optimize their decisions based on the model's judgements in practice. This research proposes a framework to explain IDSs in order to address these challenges. To facilitate the understanding of IDSs, this approach employs SHapley Additive exPlanations (SHAP), which combines local and global explanations. The local explanations explain why the model makes certain decisions based on the input. The global explanations illustrate the links between feature values and different sorts of attacks, as well as the significant features retrieved from IDSs. The interpretations of two different classifiers, a one-vs-all classifier and a multiclass classifier, are compared at the same time. The NSL-KDD dataset is used to evaluate the framework's viability. The approach described in this research improves the transparency of any IDS and aids cybersecurity personnel in better understanding the judgements of IDSs. Furthermore, the various interpretations of different types of classifiers might aid security specialists in better designing IDS architecture. More importantly, this work is groundbreaking in the field of intrusion detection because it is the first to employ the SHAP approach to explain IDSs.