Explainable Deep Learning-Based Feature Selection and Intrusion Detection Method on the Internet of Things.

Area of Science:

• Computer Science
• Cybersecurity
• Artificial Intelligence

Background:

• The Internet of Things (IoT) necessitates robust network security, with Network Intrusion Detection Systems (NIDSs) being crucial.
• Deep Learning (DL) improves NIDS performance but faces challenges in interpretability and computational efficiency.
• Feature Selection (FS) is vital for optimizing DL models in NIDSs by reducing parameters and overhead.

Purpose of the Study:

• To propose an interpretable feature selection method for detecting intrusions in encrypted network traffic.
• To address the challenges of model interpretability and lightweight deployment for DL-based NIDSs.
• To enhance the reliability and efficiency of NIDS through effective feature selection.

Main Methods:

• Developed an interpretable feature selection approach integrating SHAP (SHapley Additive exPlanations) and causality principles.
• Utilized model interpretation results to guide the feature selection process, reducing feature dimensionality.
• Evaluated the method on CICIDS2017 and NSL-KDD datasets using Convolutional Neural Networks (CNN) and Random Forest (RF) models.

Main Results:

• The proposed interpretable feature selection method demonstrated superior performance in intrusion detection.
• Reduced feature count while maintaining or improving NIDS reliability and performance.
• Validated effectiveness across different datasets and machine learning models (CNN, RF).

Conclusions:

• The SHAP and causality-based feature selection offers a reliable and interpretable solution for DL-based NIDS.
• This method effectively balances model complexity and detection performance for practical NIDS deployment.
• The approach contributes to advancing secure and efficient network intrusion detection in the IoT era.