ExplainabilityTransparencyAccountabilitycs.CR
Creating an Explainable Intrusion Detection System Using Self Organizing Maps
Jesse Ables, Thomas Kirby, William Anderson, Sudip Mittal, Shahram Rahimi, Ioana Banicescu, Maria Seale
July 15, 2022
IEEE Symposium Series on Computational Intelligence
25 citations
2 influential
Key Takeaways
-
Black box AI systems in cybersecurity lack transparency: The paper identifies that modern AI-based intrusion detection systems cannot explain their decisions to security analysts, creating a significant gap in cybersecurity operations where understanding why a threat was flagged is as important as detecting it.
-
Self-Organizing Maps offer a practical explainability solution: The researchers demonstrate that Self Organizing Maps (SOMs) can generate both "global explanations" (how the overall system works) and "local explanations" (why specific threats were flagged), making AI security decisions interpretable to human analysts without sacrificing detection capability.
-
Explainable AI can be evaluated on two dimensions: The paper shows that X-IDS systems should be assessed not only on traditional accuracy metrics but also on their ability to generate meaningful explanations, establishing a framework for measuring whether explainability features actually work in practice.
-
Visualization-based explanations make AI decisions accessible: By creating visual representations of how the system identifies intrusions, the SOM approach enables security professionals without deep AI expertise to understand and potentially challenge the system's decisions, improving trust and oversight.
Abstract
Modern Artificial Intelligence (AI) enabled Intrusion Detection Systems (IDS) are complex black boxes. This means that a security analyst will have little to no explanation or clarification on why an IDS model made a particular prediction. A potential solution to this problem is to research and develop Explainable Intrusion Detection Systems (X-IDS) based on current capabilities in Explainable Artificial Intelligence (XAI). In this paper, we create a Self Organizing Maps (SOMs) based X-IDS system that is capable of producing explanatory visualizations. We leverage SOM's explainability to create both global and local explanations. An analyst can use global explanations to get a general idea of how a particular IDS model computes predictions. Local explanations are generated for individual datapoints to explain why a certain prediction value was computed. Furthermore, our SOM based X-IDS was evaluated on both explanation generation and traditional accuracy tests using the NSL-KDD and the CIC-IDS-2017 datasets.