Search papers, labs, and topics across Lattice.
This paper introduces EXP-SEC, a framework designed to explain the decisions made by deep learning-based network intrusion detection systems (NIDS) in a manner that aligns with the expertise of security analysts. The framework features a forensic module to isolate suspect packets, an advanced explanation module that captures complex feature dependencies, and a multi-stage mapping module for translating technical explanations into domain-specific insights. Evaluation results show that EXP-SEC significantly outperforms existing explanation frameworks in utility metrics while maintaining comparable performance in traditional accuracy measures.
EXP-SEC transforms how security analysts interpret intrusion alerts by providing tailored, domain-specific explanations that enhance decision-making in real-time.
In this paper, we present EXP-SEC, a novel framework which can explain the intrusion detection decisions of DL-based NIDS (which lead to security alerts) in a way that is aligned with the domain knowledge of analysts working in Security Operations Center (SOC). We highlight the following features of our framework: (1) a forensic module that isolates the suspect packets/flow which likely caused an alert (2) an explanation module which can handle much more complex feature dependencies in network traffic than existing methods (features can be divided into overlapping groups and some groups are more important than others), and (3) a multi-stage mapping module which translates the feature/group-based explanations generated by explanation module to domain-specific explanations suitable for processing by security analysts. We evaluate EXP-SEC with state-of-the-art DL-based NIDS and our evaluation results show that EXP-SEC outperforms xNIDS (existing best performing explanation framework) in terms of group-level and overlap-aware explanation utility metrics while performing similarly in terms of conventional feature-level metrics such as descriptive accuracy, sparsity and stability. Moreover, taking the case of a state-of-the-art DL-based NIDS, we demonstrate the security analyst-friendly explanation format generated by EXP-SEC.
