Enhancing intrusion detection performance using explainable ensemble deep learning.

Area of Science:

• Computer Science
• Cybersecurity
• Artificial Intelligence

Background:

• The exponential growth of data in large networks necessitates advanced intrusion detection systems.
• Existing methods often lack accuracy and explainability, hindering effective threat identification and response.

Purpose of the Study:

• To propose a novel two-phase Explainable Ensemble deep learning (EED) method for accurate and interpretable intrusion detection.
• To enhance the understanding of attack behaviors for improved network security strategies.

Main Methods:

• A two-phase approach combining ensemble deep learning with explainability techniques.
• Phase 1: An ensemble model with three one-dimensional Long Short-Term Memory (LSTM) networks and a meta-learner for attack identification.
• Phase 2: SHape Additive exPlanations (SHAP) to interpret model outputs and highlight contributing factors.

Main Results:

• The EED method demonstrated superior accuracy in identifying and classifying network attacks compared to conventional methods.
• Experiments on real datasets validated the effectiveness of EED in both detection accuracy and output explainability.
• SHAP analysis provided clear insights into the factors driving attack classification, aiding security expert interpretation.

Conclusions:

• The EED method offers a significant advancement in intrusion detection by integrating high accuracy with transparent decision-making.
• This approach empowers security professionals with actionable insights to understand and mitigate network threats effectively.
• EED contributes to building more robust and trustworthy cybersecurity defenses in the face of evolving network data volumes and attack sophistication.