A Comparative Analysis of DNN-based White-Box Explainable AI Methods in Network Security

2025-01-14

AI Summary

This study addresses the opacity of AI-driven decision-making in cybersecurity by proposing the first end-to-end white-box eXplainable AI (XAI) framework tailored for Intrusion Detection Systems (NIDS). Leveraging deep neural networks, it systematically evaluates white-box XAI methods—including Layer-wise Relevance Propagation (LRP), Integrated Gradients (IG), and DeepLIFT—across three benchmark datasets: NSL-KDD, CICIDS-2017, and RoEduNet-SIMARGL2021. Evaluation is conducted along six dimensions—accuracy, sparsity, stability, robustness, efficiency, and completeness—from both global and local interpretability perspectives. Results demonstrate, for the first time, that white-box XAI significantly outperforms black-box alternatives in robustness and completeness, confirming its superior suitability for security-critical applications. The work establishes a comprehensive, multi-dimensional XAI evaluation framework enabling fair, cross-paradigm comparisons. All components—including models, metrics, and evaluation pipelines—are publicly released as an open-source framework.

Technology Category

• Humans and AI: Explainable AI (XAI) for Human Understanding
• Machine Learning: Transparent, Interpretable, Explainable ML
• Computer Vision: Interpretability, Explainability, and Transparency

Application Category

• Search and Retrieval-Augmented AI: Web evaluation methodologies and metrics
• Security and Privacy: Large-scale security measurements
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications

Abstract

New research focuses on creating artificial intelligence (AI) solutions for network intrusion detection systems (NIDS), drawing its inspiration from the ever-growing number of intrusions on networked systems, increasing its complexity and intelligibility. Hence, the use of explainable AI (XAI) techniques in real-world intrusion detection systems comes from the requirement to comprehend and elucidate black-box AI models to security analysts. In an effort to meet such requirements, this paper focuses on applying and evaluating White-Box XAI techniques (particularly LRP, IG, and DeepLift) for NIDS via an end-to-end framework for neural network models, using three widely used network intrusion datasets (NSL-KDD, CICIDS-2017, and RoEduNet-SIMARGL2021), assessing its global and local scopes, and examining six distinct assessment measures (descriptive accuracy, sparsity, stability, robustness, efficiency, and completeness). We also compare the performance of white-box XAI methods with black-box XAI methods. The results show that using White-box XAI techniques scores high in robustness and completeness, which are crucial metrics for IDS. Moreover, the source codes for the programs developed for our XAI evaluation framework are available to be improved and used by the research community.

Problem

• Explainable Artificial Intelligence (XAI)
• Cybersecurity
• Deep Learning

Innovation

• XAI methods
• Cybersecurity Intrusion Detection
• Interpretable AI