DeepAID: Interpreting and Improving Deep Learning-based Anomaly Detection in Security Applications

Abstract

Unsupervised Deep Learning (DL) techniques have been widely used in various security-related anomaly detection applications, owing to the great promise of being able to detect unforeseen threats and superior performance provided by Deep Neural Networks (DNN). However, the lack of interpretability creates key barriers to the adoption of DL models in practice. Unfortunately, existing interpretation approaches are proposed for supervised learning models and/or non-security domains, which are unadaptable for unsupervised DL models and fail to satisfy special requirements in security domains. In this paper, we propose DeepAID, a general framework aiming to (1) interpret DL-based anomaly detection systems in security domains, and (2) improve the practicality of these systems based on the interpretations. We first propose a novel interpretation method for unsupervised DNNs by formulating and solving well-designed optimization problems with special constraints for security domains. Then, we provide several applications based on our Interpreter as well as a model-based extension Distiller to improve security systems by solving domain-specific problems. We apply DeepAID over three types of security-related anomaly detection systems and extensively evaluate our Interpreter with representative prior works. Experimental results show that DeepAID can provide high-quality interpretations for unsupervised DL models while meeting the special requirements of security domains. We also provide several use cases to show that DeepAID can help security operators to understand model decisions, diagnose system mistakes, give feedback to models, and reduce false positives.

arXiv commentAccepted by 2021 ACM SIGSAC Conference on Computer and Communications Security (CCS '21)

References in corpus (25)

• Adam: A Method for Stochastic Optimization
• Distributed Representations of Words and Phrases and their Compositionality
• PyTorch: An Imperative Style, High-Performance Deep Learning Library
• DeepWalk: Online Learning of Social Representations
• Axiomatic Attribution for Deep Networks
• Methods for Interpreting and Understanding Deep Neural Networks
• Learning Important Features Through Propagating Activation Differences
• Graph Neural Networks: A Review of Methods and Applications
• Explaining NonLinear Classification Decisions with Deep Taylor Decomposition
• Interpretable Explanations of Black Boxes by Meaningful Perturbation
• Unsupervised Anomaly Detection via Variational Auto-Encoder for Seasonal KPIs in Web Applications
• SmoothGrad: removing noise by adding noise
• Visualizing Deep Neural Network Decisions: Prediction Difference Analysis
• Evaluating and Improving Adversarial Robustness of Machine Learning-Based Network Intrusion Detectors
• Fooling LIME and SHAP: Adversarial Attacks on Post hoc Explanation Methods
• Multifaceted Feature Visualization: Uncovering the Different Types of Features Learned By Each Neuron in Deep Neural Networks
• From Clustering to Cluster Explanations via Neural Networks
• Beyond Sparsity: Tree Regularization of Deep Models for Interpretability
• Towards Explaining Anomalies: A Deep Taylor Decomposition of One-Class Models
• Interpreting Deep Learning-Based Networking Systems
• Explaining Image Classifiers by Counterfactual Generation
• Explaining Anomalies Detected by Autoencoders Using SHAP
• EXPLAIN-IT: Towards Explainable AI for Unsupervised Network Traffic Analysis
• Rule Extraction in Unsupervised Anomaly Detection for Model Explainability: Application to OneClass SVM
• MacroBase: Prioritizing Attention in Fast Data

Cited by in corpus (2)

• SoK: Modeling Explainability in Security Analytics for Interpretability, Trustworthiness, and Usability
• FINER: Enhancing State-of-the-art Classifiers with Feature Attribution to Facilitate Security Analysis