Abstract

Cloud and IoT distributed computing environments are now being attacked by many new types of cyber threats and older rule-based intrusion detection systems (IDS) can only detect attacks they know about. Machine learning based IDS have shown better ability to detect attacks but the black box nature of these models limits the ability to understand and be trusted in security critical environments.
This research proposes an explanation-driven hybrid intrusion detection system that uses both rules and an XGBoost classification algorithm for an adaptive cyber defense against evolving network behaviors and changes in network characteristics over time. The SHapley Additive exPlanations (SHAP) method will be used to enable interpretation of the reasoning behind each detection decision at an individual instance level. Additionally, this system has an incremental learning module which allows the model to evolve with changing network behavior and concept drift as it learns from data on the network. The proposed framework was tested using a balanced sample of the CICIDS2017 data set, showing an average of 95.61% accuracy across all validation folds. These results show the effectiveness of the proposed approach to balance detection accuracy with the need for interpretability and adaptability in distributed network security.