An Explainable Deep Neural Framework for Trustworthy Network Intrusion Detection

Abstract

In recent years, there has been an increase in cyber attacks in mobile cloud environment. Intrusion Detection Systems (IDS) have played an important role in protecting mobile cloud security. Many techniques have been utilized to implement IDS, among them, machine learning-based techniques have generated promising results. Especially, complex deep neural networks show a higher detection rate than traditional machine learning models. However, the interpretation of the decision made by a neural network becomes harder to understand as its architectural complexity increases. This challenge makes it difficult for the human experts to fine-tune their detection systems, trust the detection system’s results, and make decisions accordingly when IDS systems are deployed. To address this issue, we propose an explainable intrusion detection framework that employs deep learning mechanisms to identify cyber-attacks and utilizes knowledge graph as the knowledge foundation to add human understanding of machine learning and explain the machine learning results. The use case study demonstrates that the proposed framework can not only successfully identify network intrusions but also effectively reveal important information about its internal working mechanisms of the mysterious deep learning Blackbox.