# Explaining Network Intrusion Detection System Using Explainable AI Framework

arXiv: https://arxiv.org/abs/2103.07110 · HTML: https://mlsanity.com/paper/2103.07110/

## Key facts

- Cited by 11 papers in the map (data through 14 Oct 2026).
- Builds on 6 of its 18 references that are in the map.
- First posted on arXiv 12 Mar 2021.

## Builds on (most cited first, 6 of 6)

- [A Unified Approach to Interpreting Model Predictions](https://mlsanity.com/paper/1705.07874/) (2017)
- ["Why Should I Trust You?": Explaining the Predictions of Any Classifier](https://mlsanity.com/paper/1602.04938/) (2016)
- [Explanations based on the Missing: Towards Contrastive Explanations with Pertinent Negatives](https://mlsanity.com/paper/1802.07623/) (2018)
- [One Explanation Does Not Fit All: A Toolkit and Taxonomy of AI Explainability Techniques](https://mlsanity.com/paper/1909.03012/) (2019)
- [Boolean Decision Rules via Column Generation](https://mlsanity.com/paper/1805.09901/) (2018)
- [An Adversarial Approach for Explainable AI in Intrusion Detection Systems](https://mlsanity.com/paper/1811.11705/) (2018)

## Built on by (most cited first, 11 of 11)

- [FINER: Enhancing State-of-the-art Classifiers with Feature Attribution to Facilitate Security Analysis](https://mlsanity.com/paper/2308.05362/) (2023)
- [XAI for Cybersecurity: State of the Art, Challenges, Open Issues and Future Directions](https://mlsanity.com/paper/2206.03585/) (2022)
- [Evaluating Standard Feature Sets Towards Increased Generalisability and Explainability of ML-based Network Intrusion Detection](https://mlsanity.com/paper/2104.07183/) (2021)
- [Detection, Explanation and Filtering of Cyber Attacks Combining Symbolic and Sub-Symbolic Methods](https://mlsanity.com/paper/2212.13991/) (2022)
- [A Critical Assessment of Interpretable and Explainable Machine Learning for Intrusion Detection](https://mlsanity.com/paper/2407.04009/) (2024)
- [An Adaptive End-to-End IoT Security Framework Using Explainable AI and LLMs](https://mlsanity.com/paper/2409.13177/) (2024)
- [Explainable Artificial Intelligence and Cybersecurity: A Systematic Literature Review](https://mlsanity.com/paper/2303.01259/) (2023)
- [X-CBA: Explainability Aided CatBoosted Anomal-E for Intrusion Detection System](https://mlsanity.com/paper/2402.00839/) (2024)
- [An Approach To Enhance IoT Security In 6G Networks Through Explainable AI](https://mlsanity.com/paper/2410.05310/) (2024)
- [Inherently Interpretable and Uncertainty-Aware Models for Online Learning in Cyber-Security Problems](https://mlsanity.com/paper/2411.09393/) (2024)
- [Stabilising Explainability Fragility in Cybersecurity AI: The Impact and Mitigation of Multicollinearity in Public Benchmark Datasets](https://mlsanity.com/paper/2605.22529/) (2026)

## Abstract (arXiv)

Cybersecurity is a domain where the data distribution is constantly changing with attackers exploring newer patterns to attack cyber infrastructure. Intrusion detection system is one of the important layers in cyber safety in today's world. Machine learning based network intrusion detection systems started showing effective results in recent years. With deep learning models, detection rates of network intrusion detection system are improved. More accurate the model, more the complexity and hence less the interpretability. Deep neural networks are complex and hard to interpret which makes difficult to use them in production as reasons behind their decisions are unknown. In this paper, we have used deep neural network for network intrusion detection and also proposed explainable AI framework to add transparency at every stage of machine learning pipeline. This is done by leveraging Explainable AI algorithms which focus on making ML models less of black boxes by providing explanations as to why a prediction is made. Explanations give us measurable factors as to what features influence the prediction of a cyberattack and to what degree. These explanations are generated from SHAP, LIME, Contrastive Explanations Method, ProtoDash and Boolean Decision Rules via Column Generation. We apply these approaches to NSL KDD dataset for intrusion detection system and demonstrate results.