arXiv 2602.132712026-02-04cs.AIcs.HCcs.LG

面向安全增强的人本可解释AI：一种深度入侵检测框架

Human-Centered Explainable AI for Security Enhancement: A Deep Intrusion Detection Framework

Department of Computer Science and Engineering, United International University (UIU), Dhaka 1212, Bangladesh（计算机科学与工程系，国际联合大学（UIU），达卡1212，孟加拉国）；Department of Electrical and Electronic Engineering, Islamic University of Technology, Gazipur 1704, Bangladesh（电气与电子工程系，伊斯兰科技大学，加兹ipur 1704，孟加拉国）；Department of Computer Science and Engineering (CSE), University of Asia Pacific (UAP), Dhaka 1207, Bangladesh（计算机科学与工程系（CSE），亚洲太平洋大学（UAP），达卡1207，孟加拉国）；Department of Information Systems, University of Maryland, Baltimore, 21250, Maryland, USA（信息系统系，马里兰大学，巴尔的摩，21250，美国）；College Of Information Sciences and Technology, Pennsylvania State University, University Park, PA 16802, USA（信息科学与技术学院，宾夕法尼亚州立大学，大学公园，PA 16802，美国）；Department of Information Technology, Washington University of Science and Technology, Alexandria, VA（信息技术系，科学与技术华盛顿大学，亚历山大，VA）；College of Engineering and Information Technology, University of Maryland, College Park, 20742, Maryland, USA（工程与信息技术学院，马里兰大学，学院公园，20742，美国）

Md Muntasir Jahid Ayan, Md. Shahriar Rashid, Tazzina Afroze Hassan, Hossain Md. Mubashshir Jamil, Mahbubul Islam, Lisan Al Amin, Rupak Kumar Das, Farzana Akter, Faisal Quader

DOI：: 10.1109/SoutheastCon63549.2026.11476073

阅读 PDF

arXiv 页面 ↗HTML 原文 ↗

AI总结：

本文提出一种结合可解释AI的深度入侵检测框架，利用CNN和LSTM捕捉流量序列的时间依赖性，通过SHAP实现模型可解释性，提升安全分析的透明度与可靠性。

摘要：

随着网络威胁的复杂性和频率增加，需要准确且可解释的入侵检测系统（IDS）。本文提出了一种新颖的IDS框架，整合可解释人工智能（XAI）以增强深度学习模型的透明性。该框架在NSL-KDD基准数据集上进行实验评估，显示优于传统IDS和黑箱深度学习模型。所提方法结合卷积神经网络（CNN）和长短期记忆网络（LSTM）以捕捉流量序列的时间依赖性。深度学习结果表明，CNN和LSTM的准确率均达到0.99，其中LSTM在宏平均精度、召回率和F-1分数上优于CNN。对于加权平均精度、召回率和F-1分数，两种模型得分几乎相同。为确保可解释性，XAI模型SHapley Additive exPlanations（SHAP）被纳入，使安全分析师能够理解和验证模型决策。SHAP指出，srv_serror_rate、dst_host_srv_serror_rate和serror_rate是两个模型中的一些重要特征。我们还基于IPIP6和Big Five人格特质进行了以信任为导向的专家调查，通过交互式UI评估系统的可靠性和可用性。本工作强调了在网络安全解决方案中结合性能和透明性的潜力，并通过自适应学习推荐未来改进以实现实时威胁检测。

英文摘要：

The increasing complexity and frequency of cyber-threats demand intrusion detection systems (IDS) that are not only accurate but also interpretable. This paper presented a novel IDS framework that integrated Explainable Artificial Intelligence (XAI) to enhance transparency in deep learning models. The framework was evaluated experimentally using the benchmark dataset NSL-KDD, demonstrating superior performance compared to traditional IDS and black-box deep learning models. The proposed approach combined Convolutional Neural Network (CNN) and Long Short-Term Memory (LSTM) networks for capturing temporal dependencies in traffic sequences. Our deep learning results showed that both CNN and LSTM reached 0.99 for accuracy, whereas LSTM outperformed CNN at macro average precision, recall, and F-1 score. For weighted average precision, recall, and F-1 score, both models scored almost similarly. To ensure interpretability, the XAI model SHapley Additive exPlanations (SHAP) was incorporated, enabling security analysts to understand and validate model decisions. Some notable influential features were srv_serror_rate, dst_host_srv_serror_rate, and serror_rate for both models, as pointed out by SHAP. We also conducted a trust-focused expert survey based on IPIP6 and Big Five personality traits via an interactive UI to evaluate the system's reliability and usability. This work highlighted the potential of combining performance and transparency in cybersecurity solutions and recommends future enhancements through adaptive learning for real-time threat detection.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

AI总结：

摘要：

英文摘要：

相关论文