Securing Networks: An In-Depth Analysis of Intrusion Detection using Machine Learning and Model Explanations

As cyber threats continue to evolve in complexity, the need for robust intrusion detection systems (IDS) becomes increasingly critical. Machine learning (ML) models have demon-strated their effectiveness in detecting anomalies and potential intrusions. In this article, we delve into the world of intrusion detection by exploring the application of four distinct ML models: XGBoost, Decision Trees, Random Forests, and Bagging. And leveraging the interpretability tools LIME (Local Interpretable Model-agnostic Explanations) and SHAP (SHapley Additive ex-Planations) to explain the classification results. Our exploration begins with an in-depth analysis of each machine learning model, shedding light on their strengths, weaknesses, and suitability for intrusion detection. However, machine learning models often operate as ”black boxes” making it crucial to explain their inner workings. This article introduces LIME (Local Interpretable Model-agnostic Explanations) and SHAP (SHapley Additive ex-Planations) as indispensable tools for model interpretability. Throughout the article, we demonstrate the practical application of LIME and SHAP to explain and interpret the output of our intrusion detection models. By doing so, we gain valuable insights into the decision-making process of these models, enhancing our ability to identify and respond to potential threats effectively.

@article{Vo2024,
  title     = {Securing Networks: An In-Depth Analysis of Intrusion Detection using Machine Learning and Model Explanations},
  journal   = {International Journal of Advanced Computer Science and Applications},
  volume    = {15},
  number    = {5},
  year      = {2024},
  publisher = {The Science and Information Organization},
  author    = {Hoang-Tu Vo and Nhon Nguyen Thien and Kheo Chau Mui and Phuc Pham Tien},
  doi       = {10.14569/IJACSA.2024.01505143},
  url       = {https://doi.org/10.14569/IJACSA.2024.01505143}
}