Domain Knowledge Aided Explainable Artificial Intelligence for Intrusion Detection and Response
arXiv:1911.09853
Abstract
Artificial Intelligence (AI) has become an integral part of modern-day security solutions for its ability to learn very complex functions and handling "Big Data". However, the lack of explainability and interpretability of successful AI models is a key stumbling block when trust in a model's prediction is critical. This leads to human intervention, which in turn results in a delayed response or decision. While there have been major advancements in the speed and performance of AI-based intrusion detection systems, the response is still at human speed when it comes to explaining and interpreting a specific prediction or decision. In this work, we infuse popular domain knowledge (i.e., CIA principles) in our model for better explainability and validate the approach on a network intrusion detection test case. Our experimental results suggest that the infusion of domain knowledge provides better explainability as well as a faster decision or response. In addition, the infused domain knowledge generalizes the model to work well with unknown attacks, as well as opens the path to adapt to a large stream of network traffic from numerous IoT devices.
Accepted to be published in the Proceedings of the AAAI 2020 Spring Symposium on Combining Machine Learning and Knowledge Engineering in Practice (AAAI-MAKE 2020). Stanford University, Palo Alto, California, USA, March 23-25, 2020
References in corpus (10)
- Scikit-learn: Machine Learning in Python
- SMOTE: Synthetic Minority Over-sampling Technique
- Methods for Interpreting and Understanding Deep Neural Networks
- Learning Important Features Through Propagating Activation Differences
- European Union regulations on algorithmic decision-making and a "right to explanation"
- Interpretability Beyond Feature Attribution: Quantitative Testing with Concept Activation Vectors (TCAV)
- A Parallel Random Forest Algorithm for Big Data in a Spark Cloud Computing Environment
- Mining Illegal Insider Trading of Stocks: A Proactive Approach
- Infusing domain knowledge in AI-based "black box" models for better explainability with application in bankruptcy prediction
- Credit Default Mining Using Combined Machine Learning and Heuristic Approach