Eclectic Rule Extraction for Explainability of Deep Neural Network based Intrusion Detection Systems

Black box AI explainers create a "trust paradox": While tools like LIME and SHAP are designed to make AI more transparent, they themselves operate as black boxes, making it unclear how explanations are actually generated—a fundamental problem for security-critical systems like intrusion detection.

Rule extraction offers a more trustworthy alternative: Unlike surrogate explainers, rule extraction produces human-readable rules directly from neural networks, creating genuinely transparent explanations rather than explanations about a black box.

Eclectic rule extraction balances speed and reliability: The paper demonstrates that combining pedagogical and decompositional rule extraction techniques creates a middle ground—faster than purely decompositional methods while more trustworthy than purely pedagogical approaches.

Explainability matters for cybersecurity: The research focuses on intrusion detection systems specifically because security decisions need to be understandable and verifiable; users need to trust why a system flagged a potential attack, not just accept its verdict.

Practical implementation is feasible: Testing on real-world datasets (UNSW-NB15 and CIC-IDS-2017) shows that extracting trustworthy rules from deep neural networks is achievable in practice, suggesting this approach could be deployed in actual security systems.