Abstract:Recent advancements in Intrusion Detection Systems (IDS), integrating Explainable AI (XAI) methodologies, have led to notable improvements in system performance via precise feature selection. However, a thorough understanding of cyber-attacks requires inherently explainable decision-making processes within IDS. In this paper, we present the Interpretable Generalization Mechanism (IG), poised to revolutionize IDS capabilities. IG discerns coherent patterns, making it interpretable in distinguishing between normal and anomalous network traffic. Further, the synthesis of coherent patterns sheds light on intricate intrusion pathways, providing essential insights for cybersecurity forensics. By experiments with real-world datasets NSL-KDD, UNSW-NB15, and UKM-IDS20, IG is accurate even at a low ratio of training-to-test. With 10%-to-90%, IG achieves Precision (PRE)=0.93, Recall (REC)=0.94, and Area Under Curve (AUC)=0.94 in NSL-KDD; PRE=0.98, REC=0.99, and AUC=0.99 in UNSW-NB15; and PRE=0.98, REC=0.98, and AUC=0.99 in UKM-IDS20. Notably, in UNSW-NB15, IG achieves REC=1.0 and at least PRE=0.98 since 40%-to-60%; in UKM-IDS20, IG achieves REC=1.0 and at least PRE=0.88 since 20%-to-80%. Importantly, in UKM-IDS20, IG successfully identifies all three anomalous instances without prior exposure, demonstrating its generalization capabilities. These results and inferences are reproducible. In sum, IG showcases superior generalization by consistently performing well across diverse datasets and training-to-test ratios (from 10%-to-90% to 90%-to-10%), and excels in identifying novel anomalies without prior exposure. Its interpretability is enhanced by coherent evidence that accurately distinguishes both normal and anomalous activities, significantly improving detection accuracy and reducing false alarms, thereby strengthening IDS reliability and trustworthiness.

Attribute Selection Based Genetic Network Programming for Intrusion Detection System

An Intrusion Detection Model Based On Genetic Algorithm And Neural Network

An Intrusion Detection System Using a Deep Neural Network with Gated Recurrent Units.

Adaptive Intrusion Detection Via GA-GOGMM-based Pattern Learning with Fuzzy Rough Set-Based Attribute Selection

A hybrid feature selection for network intrusion detection systems: Central points

An integrated intrusion detection system using correlation‐based attribute selection and artificial neural network

Feature Selection Based on Rough Set and Modified Genetic Algorithm for Intrusion Detection

The Application of Genetic Neural Network in Network Intrusion Detection.

Intrusion Detection for IoT Based on Improved Genetic Algorithm and Deep Belief Network.

An Online Rule Generation Model for Intrusion Detection

Combination of Feature Selection and Hybrid Classifier as to Network Intrusion Detection System Adopting FA, GWO, and BAT Optimizers

Rule constraint and evolution strategy for network intrusion detection based on gene expression programming

Feature selection of intrusion detection based on genetic algorithm

A Hybrid Visualizing Approach Based on Adaptive Neuro-fuzzy Inference System, Decision Tree, and K-means for Intrusion Detection

An Adaptive Ensemble Machine Learning Model for Intrusion Detection.

Genetic-fuzzy rule mining approach and evaluation of feature selection techniques for anomaly intrusion detection

An Efficient Network Intrusion Detection System Based on Feature Selection and Ensemble Classifier.

Intrusion Classifier Based on Multiple Attribute Selection Algorithms

An Interpretable Generalization Mechanism for Accurately Detecting Anomaly and Identifying Networking Intrusion Techniques

A hybrid interpretable deep structure based on adaptive neuro-fuzzy inference system, decision tree, and K-means for intrusion detection

Application of Improved Ggenetic Algorithm to Select Features in Intrusion Detection