Explainable AI Techniques for Intrusion Detection Systems
Abstract
The proliferation of interconnected digital systems, cloud infrastructures, Internet of Things (IoT) devices, industrial control systems, and cyber-physical infrastructures has led to a growth in the complexity of cyber security environments. MLand DL integrated into modern IDSs to identify complex activities in the traffic flows. Explainable Artificial Intelligence (XAI) is becoming a critical element in IDSs, helping analysts grasp the AI process through feature-level explanations, explanation of the set of features used for each prediction, and the visual representation of complex model decision-making processes. Shapley Additive Explanations (SHAP), Local Interpretable Model-Agnostic Explanations (LIME), are frequently employed in recent Pub Med-indexed XAI research on IoT, network and botnet intrusion detection systems using multiple learning models. This chapter explores the application of these XAI techniques for intrusion detection, including the types of explanation, the evaluation of explanations, and current challenges in achieving explainability for ML/ DL-based IDSs.
