基于可解释学习的物联网安全通用入侵检测系统

Explainable Learning Based Network Intrusion Detection System for IoT Security

该研究通过评估一个通用特征集对不同网络环境和攻击类型的泛化性能,旨在缩小和实际应用的差距.分别在三个数据集上对两个特征集(NetFlow和CICFlowMeter)进行了评估.实验结果表明,NetFlow特征集显著提高了两种机器学习模型在不同数据集上检测入侵的准确性.此外,由于学习模型的复杂性,一种可解释的人工智能方法(SHAP),被用来解释两个机器学习模型的分类决策.通过在多个不同数据集上分析了特征的Shapley值,以确定每个特征对最终机器学习模型预测结果的影响.

By evaluating the generalization performance of a common feature set for different network environments and attack types,this study aims to narrow the gap between the application and the actual application.Two feature sets(NetFlow and CICFlowMeter)are evaluated on three datasets.The experimental results show that NetFlow feature set can significantly improve the accuracy of intrusion detection on different data sets.In addition,due to the complexity of the learning model,an interpretable artificial intelligence method(SHAP)is used to explain the classification decisions of two machine learning models.In order to determine the influence of each feature on the prediction results of the final machine learning based model,the shapley values of features are analyzed on several different datasets.