ExpIDS: A Drift-adaptable Network Intrusion Detection System With Improved Explainability

2025-09-25

AI Summary

Cybersecurity experts often distrust black-box machine learning–based Network Intrusion Detection Systems (NIDS) due to poor decision transparency and limited adaptability to network traffic distribution shifts. To address this, we propose a deep learning–based NIDS that jointly achieves high explanation fidelity and concept drift adaptability. Our approach integrates an interpretability-driven deep neural network with decision-tree approximation to ensure consistency between local and global explanations; it further incorporates a lightweight online drift detection mechanism coupled with incremental retraining. Experiments across multiple real-world concept drift scenarios demonstrate that our system matches state-of-the-art models in malicious traffic detection accuracy while significantly improving explanation consistency (+23.6%). This work effectively bridges the gap among model performance, interpretability, and robustness in dynamic network environments.

Technology Category

• Machine Learning: Transparent, Interpretable, Explainable ML
• Computer Vision: Interpretability, Explainability, and Transparency
• Natural Language Processing: Interpretability, Analysis, and Evaluation of NLP Models

Application Category

• Graph Algorithms and Modeling for the Web: Graph neural networks and deep learning approaches for Web-related graphs
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

Despite all the advantages associated with Network Intrusion Detection Systems (NIDSs) that utilize machine learning (ML) models, there is a significant reluctance among cyber security experts to implement these models in real-world production settings. This is primarily because of their opaque nature, meaning it is unclear how and why the models make their decisions. In this work, we design a deep learning-based NIDS, ExpIDS to have high decision tree explanation fidelity, i.e., the predictions of decision tree explanation corresponding to ExpIDS should be as close to ExpIDS's predictions as possible. ExpIDS can also adapt to changes in network traffic distribution (drift). With the help of extensive experiments, we verify that ExpIDS achieves higher decision tree explanation fidelity and a malicious traffic detection performance comparable to state-of-the-art NIDSs for common attacks with varying levels of real-world drift.

Problem

• Addressing the opaque decision-making of ML-based intrusion detection systems
• Improving explanation fidelity while maintaining high detection performance
• Adapting to network traffic distribution changes (drift) in real-world settings

Innovation

• Deep learning-based NIDS with high decision tree explanation fidelity
• Adapts to network traffic distribution changes (drift)
• Achieves comparable detection performance to state-of-the-art systems