使用MLP和XAI分析零日攻击检测
Analysis of Zero Day Attack Detection Using MLP and XAI
AI总结：
本文分析基于ML和DL的入侵检测系统，评估四种MLP模型在KDD99数据集上的零日攻击检测性能，并利用SHAP解释器验证特征重要性，发现截断模型准确率最高且加权截断模型偏差更小。
摘要：
任何利用零日漏洞的漏洞利用都被称为零日攻击。以往的研究和社交媒体趋势表明，对零日攻击检测的研究存在巨大需求。本文分析了基于机器学习（ML）和深度学习（DL）的方法来创建入侵检测系统（IDS），并利用可解释AI（XAI）对其进行审查，方法是通过基于从测试集中随机采样的数据训练一个解释器。重点是使用KDD99数据集，该数据集在所有用于检测零日攻击的数据集中拥有最多的研究。本文旨在合成该数据集以使其具有更少的类别用于多类分类，测试ML和DL方法在模式识别上的表现，确立模型的鲁棒性和可靠性，并确立模型的可解释性和可扩展性。我们评估了在KDD99数据集上训练的四种多层感知机（MLP）的性能，包括基线ML模型、加权ML模型、截断ML模型和加权截断ML模型。我们的结果表明，截断ML模型实现了最高的准确率（99.62%）、精确率和召回率，而加权截断ML模型显示出较低的准确率（97.26%），但在所有类别中具有更好的类别表示（更少的偏差）以及改进的未加权召回率得分。我们还使用了Shapley加性解释（SHAP）为我们的截断模型训练解释器，以检查两个加权模型和未加权模型之间的特征重要性。
英文摘要：
Any exploit taking advantage of zero-day is called a zero-day attack. Previous research and social media trends show a massive demand for research in zero-day attack detection. This paper analyzes Machine Learning (ML) and Deep Learning (DL) based approaches to create Intrusion Detection Systems (IDS) and scrutinizing them using Explainable AI (XAI) by training an explainer based on randomly sampled data from the testing set. The focus is on using the KDD99 dataset, which has the most research done among all the datasets for detecting zero-day attacks. The paper aims to synthesize the dataset to have fewer classes for multi-class classification, test ML and DL approaches on pattern recognition, establish the robustness and dependability of the model, and establish the interpretability and scalability of the model. We evaluated the performance of four multilayer perceptron (MLP) trained on the KDD99 dataset, including baseline ML models, weighted ML models, truncated ML models, and weighted truncated ML models. Our results demonstrate that the truncated ML model achieves the highest accuracy (99.62%), precision, and recall, while weighted truncated ML model shows lower accuracy (97.26%) but better class representation (less bias) among all the classes with improved unweighted recall score. We also used Shapely Additive exPlanations (SHAP) to train explainer for our truncated models to check for feature importance among the two weighted and unweighted models.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
