Inherently Interpretable and Uncertainty-Aware Models for Online Learning in Cyber-Security Problems

Benjamin Kolicic,Alberto Caron,Chris Hicks,Vasilios Mavroudis

2024-11-14

Abstract:In this paper, we address the critical need for interpretable and uncertainty-aware machine learning models in the context of online learning for high-risk industries, particularly cyber-security. While deep learning and other complex models have demonstrated impressive predictive capabilities, their opacity and lack of uncertainty quantification present significant questions about their trustworthiness. We propose a novel pipeline for online supervised learning problems in cyber-security, that harnesses the inherent interpretability and uncertainty awareness of Additive Gaussian Processes (AGPs) models. Our approach aims to balance predictive performance with transparency while improving the scalability of AGPs, which represents their main drawback, potentially enabling security analysts to better validate threat detection, troubleshoot and reduce false positives, and generally make trustworthy, informed decisions. This work contributes to the growing field of interpretable AI by proposing a class of models that can be significantly beneficial for high-stake decision problems such as the ones typical of the cyber-security domain. The source code is available.

Machine Learning

What problem does this paper attempt to address?

This paper attempts to address the issues of interpretability and uncertainty quantification of machine - learning models in the online - learning environment in the field of network security. Specifically:

1. **Limitations of deep - learning models**: Although deep - learning and other complex models perform excellently in prediction capabilities, their opacity and lack of uncertainty quantification make the trustworthiness of these models in high - risk industries (such as network security) questioned.

2. **Importance of interpretability and uncertainty**: In high - risk environments such as network security, the interpretability and uncertainty quantification of models are crucial. These features can help security analysts verify threat detection, reduce false positives, and effectively prioritize alerts. In addition, interpretable models are also very important for regulatory compliance and legal contexts.

3. **Proposed new method**: The paper proposes a new online supervised - learning pipeline based on Additive Gaussian Processes (AGPs). The AGPs model has inherent interpretability and uncertainty awareness and can improve transparency while maintaining prediction performance. This method aims to balance prediction performance and transparency and improve the scalability of AGPs, thereby helping security analysts better verify threat detection, troubleshoot, and reduce false positives, and make reliable and informed decisions.

4. **Shortcomings of existing methods**: Although existing interpretability methods (such as SHAP and LIME) can explain the decisions of pre - trained models post - hoc, they may have problems of inaccuracy and inconsistency. In contrast, inherently interpretable models (such as linear regression and decision trees) prioritize transparency from the start, ensuring faithful and consistent explanations, but may sacrifice prediction performance.

5. **Challenges in the online - learning environment**: The paper specifically focuses on the general online machine - learning setting, which is a common scenario in network - security problems. AGPs have never been applied to network - security problems and have serious scalability issues on large - scale, feature - rich datasets. By improving the online - learning pipeline, the authors have successfully alleviated these problems without significant loss of model performance.

In summary, the main objective of this paper is to solve the problems of interpretability and uncertainty quantification of machine - learning models in the online - learning environment in the field of network security by introducing Additive Gaussian Processes (AGPs), thereby improving the credibility and practicality of the models.