Research And Iplementation Of Iterpretability Of Itrusion Dtection Model

In recent years,the rapid development of the Internet has brought great convenience to people’s life,and the social mode of production has undergone great changes.However,with the increasing network attacks,national security,enterprise security and personal security are facing major challenges.As an important means to detect and resist network attacks,intrusion detection system has always been the focus of academia and industry.At present,network-based intrusion detection systems mainly use machine learning and deep learning methods.Machine learning has limitations in processing large-scale data.At the same time,the algorithm performance of machine learning depends on the accuracy of identifying and extracting features,while deep learning can process large-scale data and omit the process of manually extracting features in machine learning,Automatic recognition of high-dimensional features directly through training greatly reduces the difficulty of manual feature selection.Nowadays,deep learning technology plays an important role in intrusion detection and has achieved good detection results.However,deep learning also has some limitations,that is,the lack of explicability is still a major obstacle to the adoption of deep learning model in practice.The complex model makes it impossible for us to know the reasons for its decision-making.This also hinders the further development of intrusion detection system based on deep learning.To solve the above problems,this paper designs and implements a GC-IDS(CNN+ Bi-GRU based Intrusion Detection System)model based on the combination of CNN and LSTM to improve the recognition performance of two classification tasks and multi classification tasks of intrusion detection system.Then,the popular machine / deep learning model interpretable technology is used to explain the GC-IDS model,increase the reliability of the model,and understand the key characteristic elements of intrusion detection in the model,which is of positive significance to further improve the performance of the model and reduce the false positive rate.The contributions of this paper are as follows:(1)A new deep learning based intrusion detection model GC-IDS is proposed.Compared with the existing intrusion detection models,the model has higher accuracy in both binary and multi-classification.(2)We apply the model interpretation SHAP(Shapley Additive ex Planations)method to perform local and global interpretations of the intrusion detection deep learning model to improve the transparency of the deep learning model.Experiments show that the features identified by this method accord with the principle of each attack,and have good robustness and generalization ability.(3)We built and implemented an intrusion detection system based on deep learning and XAI(Explainable Artificial Intelligence).The system uses the deep learning model proposed in this paper and applies model interpretation technology to improve the accuracy of the system and reduce the false positive rate,while improving the interpretability of the system.The interpretable system improves the trust of users and provides users with decision-making basis.