# Creating an Explainable Intrusion Detection System Using Self Organizing Maps

arXiv: https://arxiv.org/abs/2207.07465 · HTML: https://mlsanity.com/paper/2207.07465/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- Builds on 10 of its 62 references that are in the map.
- First posted on arXiv 15 Jul 2022.

## Builds on (most cited first, 10 of 10)

- [A Unified Approach to Interpreting Model Predictions](https://mlsanity.com/paper/1705.07874/) (2017)
- ["Why Should I Trust You?": Explaining the Predictions of Any Classifier](https://mlsanity.com/paper/1602.04938/) (2016)
- [Layer-wise Relevance Propagation for Neural Networks with Local Renormalization Layers](https://mlsanity.com/paper/1604.00825/) (2016)
- [What do we need to build explainable AI systems for the medical domain?](https://mlsanity.com/paper/1712.09923/) (2017)
- [Explainable Deep Few-shot Anomaly Detection with Deviation Networks](https://mlsanity.com/paper/2108.00462/) (2021)
- [Explainable Intrusion Detection Systems (X-IDS): A Survey of Current Methods, Challenges, and Opportunities](https://mlsanity.com/paper/2207.06236/) (2022)
- [Domain Knowledge Aided Explainable Artificial Intelligence for Intrusion Detection and Response](https://mlsanity.com/paper/1911.09853/) (2019)
- [Evolution and Detection of Polymorphic and Metamorphic Malwares: A Survey](https://mlsanity.com/paper/1406.7061/) (2014)
- [Analyzing CNN Based Behavioural Malware Detection Techniques on Cloud IaaS](https://mlsanity.com/paper/2002.06383/) (2020)
- [An Intrusion Detection System based on Deep Belief Networks](https://mlsanity.com/paper/2207.02117/) (2022)

## Built on by (most cited first, 6 of 6)

- [Impacts and Risk of Generative AI Technology on Cyber Defense](https://mlsanity.com/paper/2306.13033/) (2023)
- [TwinExplainer: Explaining Predictions of an Automotive Digital Twin](https://mlsanity.com/paper/2302.00152/) (2023)
- [Explainable Intrusion Detection Systems Using Competitive Learning Techniques](https://mlsanity.com/paper/2303.17387/) (2023)
- [Eclectic Rule Extraction for Explainability of Deep Neural Network based Intrusion Detection Systems](https://mlsanity.com/paper/2401.10207/) (2024)
- [Self-organizing maps for water quality assessment in reservoirs and lakes: A systematic literature review](https://mlsanity.com/paper/2512.18466/) (2025)
- [parHSOM: A novel parallel Hierarchical Self-Organizing Map implementation](https://mlsanity.com/paper/2605.08164/) (2026)

## Abstract (arXiv)

Modern Artificial Intelligence (AI) enabled Intrusion Detection Systems (IDS) are complex black boxes. This means that a security analyst will have little to no explanation or clarification on why an IDS model made a particular prediction. A potential solution to this problem is to research and develop Explainable Intrusion Detection Systems (X-IDS) based on current capabilities in Explainable Artificial Intelligence (XAI). In this paper, we create a Self Organizing Maps (SOMs) based X-IDS system that is capable of producing explanatory visualizations. We leverage SOM's explainability to create both global and local explanations. An analyst can use global explanations to get a general idea of how a particular IDS model computes predictions. Local explanations are generated for individual datapoints to explain why a certain prediction value was computed. Furthermore, our SOM based X-IDS was evaluated on both explanation generation and traditional accuracy tests using the NSL-KDD and the CIC-IDS-2017 datasets.