Explainable Intrusion Detection Systems (X-IDS): A Survey of Current Methods, Challenges, and Opportunities
The application of Artificial Intelligence (AI) and Machine Learning (ML) to cybersecurity challenges has gained traction in industry and academia, partially as a result of widespread malware attacks on critical systems such as cloud infrastructures and government institutions. Intrusion Detection S...
| Main Authors: | , , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2022-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/9927396/ |
| _version_ | 1811194229283618816 |
|---|---|
| author | Subash Neupane Jesse Ables William Anderson Sudip Mittal Shahram Rahimi Ioana Banicescu Maria Seale |
| author_facet | Subash Neupane Jesse Ables William Anderson Sudip Mittal Shahram Rahimi Ioana Banicescu Maria Seale |
| author_sort | Subash Neupane |
| collection | DOAJ |
| description | The application of Artificial Intelligence (AI) and Machine Learning (ML) to cybersecurity challenges has gained traction in industry and academia, partially as a result of widespread malware attacks on critical systems such as cloud infrastructures and government institutions. Intrusion Detection Systems (IDS), using some forms of AI, have received widespread adoption due to their ability to handle vast amounts of data with a high prediction accuracy. These systems are hosted in the organizational Cyber Security Operation Center (CSoC) as a defense tool to monitor and detect malicious network flow that would otherwise impact the Confidentiality, Integrity, and Availability (CIA). CSoC analysts rely on these systems to make decisions about the detected threats. However, IDSs designed using Deep Learning (DL) techniques are often treated as black box models and do not provide a justification for their predictions. This creates a barrier for CSoC analysts, as they are unable to improve their decisions based on the model’s predictions. One solution to this problem is to design explainable IDS (X-IDS). This survey reviews the state-of-the-art in explainable AI (XAI) for IDS, its current challenges, and discusses how these challenges span to the design of an X-IDS. In particular, we discuss black box and white box approaches comprehensively. We also present the tradeoff between these approaches in terms of their performance and ability to produce explanations. Furthermore, we propose a generic architecture that considers human-in-the-loop which can be used as a guideline when designing an X-IDS. Research recommendations are given from three critical viewpoints: the need to define explainability for IDS, the need to create explanations tailored to various stakeholders, and the need to design metrics to evaluate explanations. |
| first_indexed | 2024-04-12T00:22:26Z |
| format | Article |
| id | doaj.art-a078bddcabed4eee81d1290dfad1622c |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-04-12T00:22:26Z |
| publishDate | 2022-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-a078bddcabed4eee81d1290dfad1622c2022-12-22T03:55:41ZengIEEEIEEE Access2169-35362022-01-011011239211241510.1109/ACCESS.2022.32166179927396Explainable Intrusion Detection Systems (X-IDS): A Survey of Current Methods, Challenges, and OpportunitiesSubash Neupane0https://orcid.org/0000-0001-9260-3914Jesse Ables1William Anderson2Sudip Mittal3https://orcid.org/0000-0001-9151-8347Shahram Rahimi4Ioana Banicescu5https://orcid.org/0000-0001-5206-1436Maria Seale6Department of Computer Science and Engineering, Mississippi State University, Mississippi, MS, USADepartment of Computer Science and Engineering, Mississippi State University, Mississippi, MS, USADepartment of Computer Science and Engineering, Mississippi State University, Mississippi, MS, USADepartment of Computer Science and Engineering, Mississippi State University, Mississippi, MS, USADepartment of Computer Science and Engineering, Mississippi State University, Mississippi, MS, USADepartment of Computer Science and Engineering, Mississippi State University, Mississippi, MS, USAU.S. Army Engineer Research and Development Center, Vicksburg, Mississippi, MS, USAThe application of Artificial Intelligence (AI) and Machine Learning (ML) to cybersecurity challenges has gained traction in industry and academia, partially as a result of widespread malware attacks on critical systems such as cloud infrastructures and government institutions. Intrusion Detection Systems (IDS), using some forms of AI, have received widespread adoption due to their ability to handle vast amounts of data with a high prediction accuracy. These systems are hosted in the organizational Cyber Security Operation Center (CSoC) as a defense tool to monitor and detect malicious network flow that would otherwise impact the Confidentiality, Integrity, and Availability (CIA). CSoC analysts rely on these systems to make decisions about the detected threats. However, IDSs designed using Deep Learning (DL) techniques are often treated as black box models and do not provide a justification for their predictions. This creates a barrier for CSoC analysts, as they are unable to improve their decisions based on the model’s predictions. One solution to this problem is to design explainable IDS (X-IDS). This survey reviews the state-of-the-art in explainable AI (XAI) for IDS, its current challenges, and discusses how these challenges span to the design of an X-IDS. In particular, we discuss black box and white box approaches comprehensively. We also present the tradeoff between these approaches in terms of their performance and ability to produce explanations. Furthermore, we propose a generic architecture that considers human-in-the-loop which can be used as a guideline when designing an X-IDS. Research recommendations are given from three critical viewpoints: the need to define explainability for IDS, the need to create explanations tailored to various stakeholders, and the need to design metrics to evaluate explanations.https://ieeexplore.ieee.org/document/9927396/Explainable intrusion detection systemsexplainable artificial intelligencemachine learningdeep learningwhite boxblack box |
| spellingShingle | Subash Neupane Jesse Ables William Anderson Sudip Mittal Shahram Rahimi Ioana Banicescu Maria Seale Explainable Intrusion Detection Systems (X-IDS): A Survey of Current Methods, Challenges, and Opportunities IEEE Access Explainable intrusion detection systems explainable artificial intelligence machine learning deep learning white box black box |
| title | Explainable Intrusion Detection Systems (X-IDS): A Survey of Current Methods, Challenges, and Opportunities |
| title_full | Explainable Intrusion Detection Systems (X-IDS): A Survey of Current Methods, Challenges, and Opportunities |
| title_fullStr | Explainable Intrusion Detection Systems (X-IDS): A Survey of Current Methods, Challenges, and Opportunities |
| title_full_unstemmed | Explainable Intrusion Detection Systems (X-IDS): A Survey of Current Methods, Challenges, and Opportunities |
| title_short | Explainable Intrusion Detection Systems (X-IDS): A Survey of Current Methods, Challenges, and Opportunities |
| title_sort | explainable intrusion detection systems x ids a survey of current methods challenges and opportunities |
| topic | Explainable intrusion detection systems explainable artificial intelligence machine learning deep learning white box black box |
| url | https://ieeexplore.ieee.org/document/9927396/ |
| work_keys_str_mv | AT subashneupane explainableintrusiondetectionsystemsxidsasurveyofcurrentmethodschallengesandopportunities AT jesseables explainableintrusiondetectionsystemsxidsasurveyofcurrentmethodschallengesandopportunities AT williamanderson explainableintrusiondetectionsystemsxidsasurveyofcurrentmethodschallengesandopportunities AT sudipmittal explainableintrusiondetectionsystemsxidsasurveyofcurrentmethodschallengesandopportunities AT shahramrahimi explainableintrusiondetectionsystemsxidsasurveyofcurrentmethodschallengesandopportunities AT ioanabanicescu explainableintrusiondetectionsystemsxidsasurveyofcurrentmethodschallengesandopportunities AT mariaseale explainableintrusiondetectionsystemsxidsasurveyofcurrentmethodschallengesandopportunities |