Abstract:This paper addresses trust issues created from the ubiquity of black box algorithms and surrogate explainers in Explainable Intrusion Detection Systems (X-IDS). While Explainable Artificial Intelligence (XAI) aims to enhance transparency, black box surrogate explainers, such as Local Interpretable Model-Agnostic Explanation (LIME) and SHapley Additive exPlanation (SHAP), are difficult to trust. The black box nature of these surrogate explainers makes the process behind explanation generation opaque and difficult to understand. To avoid this problem, one can use transparent white box algorithms such as Rule Extraction (RE). There are three types of RE algorithms: pedagogical, decompositional, and eclectic. Pedagogical methods offer fast but untrustworthy white-box explanations, while decompositional RE provides trustworthy explanations with poor scalability. This work explores eclectic rule extraction, which strikes a balance between scalability and trustworthiness. By combining techniques from pedagogical and decompositional approaches, eclectic rule extraction leverages the advantages of both, while mitigating some of their drawbacks. The proposed Hybrid X-IDS architecture features eclectic RE as a white box surrogate explainer for black box Deep Neural Networks (DNN). The presented eclectic RE algorithm extracts human-readable rules from hidden layers, facilitating explainable and trustworthy rulesets. Evaluations on UNSW-NB15 and CIC-IDS-2017 datasets demonstrate the algorithm's ability to generate rulesets with 99.9% accuracy, mimicking DNN outputs. The contributions of this work include the hybrid X-IDS architecture, the eclectic rule extraction algorithm applicable to intrusion detection datasets, and a thorough analysis of performance and explainability, demonstrating the trade-offs involved in rule extraction speed and accuracy.

Rule Reduction after Knowledge Graph Mining for Cyber Situational Awareness Analysis

Extracting method knowledge elements from scientific literature: A rule‐based approach

Knowledge Reasoning via Jointly Modeling Knowledge Graphs and Soft Rules

Ruleformer: Context-aware Rule Mining over Knowledge Graph.

Negative Rules and Reduction in Rough Sets Based on Similarity Relation

Building Rule Hierarchies for Efficient Logical Rule Learning from Knowledge Graphs

Semantic Graph Mining for e-Science

Rule mining over knowledge graphs via reinforcement learning

A Comprehensive Study on Knowledge Graph Embedding over Relational Patterns Based on Rule Learning

ChatRule: Mining Logical Rules with Large Language Models for Knowledge Graph Reasoning

Advancing rule learning in knowledge graphs with structure-aware graph transformer

Rule-based data augmentation for knowledge graph embedding

GRG: KNOWLEDGE DISCOVERY USING INFORMATION GENERALIZATION, INFORMATION REDUCTION, AND RULE GENERATION

From Chain to Tree: Refining Chain-like Rules into Tree-like Rules on Knowledge Graphs

Simple Augmentations of Logical Rules for Neuro-Symbolic Knowledge Graph Completion

A Hybrid Model for Learning Embeddings and Logical Rules Simultaneously from Knowledge Graphs

A novel extended rule-based system based on K-Nearest Neighbor graph

RulE: Neural-Symbolic Knowledge Graph Reasoning with Rule Embedding

RDF2Rules: Learning Rules from RDF Knowledge Bases by Mining Frequent Predicate Cycles.

Ruleformer: Context-aware Differentiable Rule Mining over Knowledge Graph

Eclectic Rule Extraction for Explainability of Deep Neural Network based Intrusion Detection Systems