Abstract:Recent advancements in Intrusion Detection Systems (IDS), integrating Explainable AI (XAI) methodologies, have led to notable improvements in system performance via precise feature selection. However, a thorough understanding of cyber-attacks requires inherently explainable decision-making processes within IDS. In this paper, we present the Interpretable Generalization Mechanism (IG), poised to revolutionize IDS capabilities. IG discerns coherent patterns, making it interpretable in distinguishing between normal and anomalous network traffic. Further, the synthesis of coherent patterns sheds light on intricate intrusion pathways, providing essential insights for cybersecurity forensics. By experiments with real-world datasets NSL-KDD, UNSW-NB15, and UKM-IDS20, IG is accurate even at a low ratio of training-to-test. With 10%-to-90%, IG achieves Precision (PRE)=0.93, Recall (REC)=0.94, and Area Under Curve (AUC)=0.94 in NSL-KDD; PRE=0.98, REC=0.99, and AUC=0.99 in UNSW-NB15; and PRE=0.98, REC=0.98, and AUC=0.99 in UKM-IDS20. Notably, in UNSW-NB15, IG achieves REC=1.0 and at least PRE=0.98 since 40%-to-60%; in UKM-IDS20, IG achieves REC=1.0 and at least PRE=0.88 since 20%-to-80%. Importantly, in UKM-IDS20, IG successfully identifies all three anomalous instances without prior exposure, demonstrating its generalization capabilities. These results and inferences are reproducible. In sum, IG showcases superior generalization by consistently performing well across diverse datasets and training-to-test ratios (from 10%-to-90% to 90%-to-10%), and excels in identifying novel anomalies without prior exposure. Its interpretability is enhanced by coherent evidence that accurately distinguishes both normal and anomalous activities, significantly improving detection accuracy and reducing false alarms, thereby strengthening IDS reliability and trustworthiness.

Reduction on False Positive Rate of Anomaly IDS

Use of host's software information to mitigate false positive in signature-based NIDS

Pre-decision Detection Engine for Signature-Based Network Intrusion Detection System

A Mixed Intrusion Detection System Utilizing K-means and Extreme Gradient Boosting

Using Outlier Detection to Reduce False Positives in Intrusion Detection

Study of Adaptive Intrusion Detection with Data Mining

Packet Payload Based Anomalous Network Intrusion Detection

Hybrid Network Intrusion Detection System

Multi-agent based hybrid Intrusion detection system

Should I Raise The Red Flag? A comprehensive survey of anomaly scoring methods toward mitigating false alarms

Analyzing and Improving Performance of a Class of Anomaly-based Intrusion Detectors

Research of Anomaly Detection Method Based on Improved Artificial Immunity

A Rough Set Theory Based Method for Anomaly Intrusion Detection in Computer Network Systems

Unraveling False Positives in Unsupervised Defect Detection Models: A Study on Anomaly-Free Training Datasets

Class Outlier Detection Algorithm and Application in IDS Model

Network Intrusion Detection Method Based on Rough Set Theory

An Interpretable Generalization Mechanism for Accurately Detecting Anomaly and Identifying Networking Intrusion Techniques

Enhancing Anomaly Detection Models for Industrial Applications through SVM-Based False Positive Classification

Attribute Weighting with Adaptive NBTree for Reducing False Positives in Intrusion Detection

An Improved Real-Valued Negative Selection Algorithm Based on the Constant Detector for Anomaly Detection

A Novel Data Mining-Based Method for Alert Reduction and Analysis.