Cổng tri thức PTIT

Bài báo quốc tế

Kho tri thức

/

/

Mind the Gap: On the Practical Utility of SHAP for Deep Learning-Based Intrusion Detection

Mind the Gap: On the Practical Utility of SHAP for Deep Learning-Based Intrusion Detection

Đỗ Phúc Hảo

The increasing sophistication of cyber threats necessitates the use of advanced techniques like Deep Learning (DL) for Network Intrusion Detection Systems (NIDS. While DL models achieve high accuracy, their ”black-box” nature hinders their adoption in real-world security operations, where transparency and trust are paramount. This paper investigates the practical chal lenges of applying Explainable AI (xAI) to this problem by critically analyzing the outputs of a standard xAI framework on a high-performance NIDS model. We use a Deep Neural Network (DNN) trained on the widely used CIC-IDS-2017 dataset as a baseline model, achieving an F1-score of 0.99 for attack detection. We then em ploy SHAP to scrutinize the operational utility of the generated explanations. Our analysis reveals a critical ”last-mile” problem in explainability, demonstrating that raw, unprocessed xAI outputs can be unintelligible to security practitioners due to standard data preprocessing steps like feature scaling. The results show that while xAI can identify influential features, significant post processing and contextualization are required to translate these outputs into genuinely transparent and actionable insights, highlighting a crucial gap between theoretical explainability and practical application in cybersecurity.

Xuất bản trên:

Mind the Gap: On the Practical Utility of SHAP for Deep Learning-Based Intrusion Detection

Ngày đăng:

2025

DOI:


Nhà xuất bản:

Địa điểm:


Từ khoá:

Network Intrusion Detection, Explain able AI (xAI), SHAP, Deep Learning, Cybersecurity, CIC IDS-2017.