# Explainable Intrusion Detection Systems Using Competitive Learning Techniques

arXiv: https://arxiv.org/abs/2303.17387 · HTML: https://mlsanity.com/paper/2303.17387/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 11 of its 88 references that are in the map.
- First posted on arXiv 30 Mar 2023.

## Builds on (most cited first, 11 of 11)

- [A Unified Approach to Interpreting Model Predictions](https://mlsanity.com/paper/1705.07874/) (2017)
- ["Why Should I Trust You?": Explaining the Predictions of Any Classifier](https://mlsanity.com/paper/1602.04938/) (2016)
- [Layer-wise Relevance Propagation for Neural Networks with Local Renormalization Layers](https://mlsanity.com/paper/1604.00825/) (2016)
- [What do we need to build explainable AI systems for the medical domain?](https://mlsanity.com/paper/1712.09923/) (2017)
- [Explainable Deep Few-shot Anomaly Detection with Deviation Networks](https://mlsanity.com/paper/2108.00462/) (2021)
- [Explainable Intrusion Detection Systems (X-IDS): A Survey of Current Methods, Challenges, and Opportunities](https://mlsanity.com/paper/2207.06236/) (2022)
- [Domain Knowledge Aided Explainable Artificial Intelligence for Intrusion Detection and Response](https://mlsanity.com/paper/1911.09853/) (2019)
- [Evolution and Detection of Polymorphic and Metamorphic Malwares: A Survey](https://mlsanity.com/paper/1406.7061/) (2014)
- [Analyzing CNN Based Behavioural Malware Detection Techniques on Cloud IaaS](https://mlsanity.com/paper/2002.06383/) (2020)
- [Creating an Explainable Intrusion Detection System Using Self Organizing Maps](https://mlsanity.com/paper/2207.07465/) (2022)
- [A Temporal Anomaly Detection System for Vehicles utilizing Functional Working Groups and Sensor Channels](https://mlsanity.com/paper/2209.06828/) (2022)

## Built on by (most cited first, 2 of 2)

- [Eclectic Rule Extraction for Explainability of Deep Neural Network based Intrusion Detection Systems](https://mlsanity.com/paper/2401.10207/) (2024)
- [parHSOM: A novel parallel Hierarchical Self-Organizing Map implementation](https://mlsanity.com/paper/2605.08164/) (2026)

## Abstract (arXiv)

The current state of the art systems in Artificial Intelligence (AI) enabled intrusion detection use a variety of black box methods. These black box methods are generally trained using Error Based Learning (EBL) techniques with a focus on creating accurate models. These models have high performative costs and are not easily explainable. A white box Competitive Learning (CL) based eXplainable Intrusion Detection System (X-IDS) offers a potential solution to these problem. CL models utilize an entirely different learning paradigm than EBL approaches. This different learning process makes the CL family of algorithms innately explainable and less resource intensive. In this paper, we create an X-IDS architecture that is based on DARPA's recommendation for explainable systems. In our architecture we leverage CL algorithms like, Self Organizing Maps (SOM), Growing Self Organizing Maps (GSOM), and Growing Hierarchical Self Organizing Map (GHSOM). The resulting models can be data-mined to create statistical and visual explanations. Our architecture is tested using NSL-KDD and CIC-IDS-2017 benchmark datasets, and produces accuracies that are 1% - 3% less than EBL models. However, CL models are much more explainable than EBL models. Additionally, we use a pruning process that is able to significantly reduce the size of these CL based models. By pruning our models, we are able to increase prediction speeds. Lastly, we analyze the statistical and visual explanations generated by our architecture, and we give a strategy that users could use to help navigate the set of explanations. These explanations will help users build trust with an Intrusion Detection System (IDS), and allow users to discover ways to increase the IDS's potency.