Improving User Trust on Deep Neural Networks Based Intrusion Detection Systems
Kasun Amarasinghe, Milos Manic · 2018
Deep Neural Networks based intrusion detection systems (DNN-IDS) have proven to be effective. However, in domains like critical infrastructure security, user trust on the DNN-IDS is imperative and high accuracy isn't sufficient. The black-box nature of DNNs hinders transparency of the DNN-IDS, which is necessary for building trust. The main objective of this work is to improve user trust by improving transparency of the DNN-IDS by making it more communicative. This paper presents a methodology to generate offline and online feedback to the user on the decision making process of the DNN-IDS. Offline, the user is reported the input features that are most relevant in detecting each type of intrusion by the trained DNN-IDS. Online, for each detection, the user is reported the inputs features that contributed most to the detection. The presented method was implemented on the KDD-NSL dataset with a multi-layer perceptron (MLP) based DNN-IDS. Binary and multi-class classification was carried out on the dataset. Further, several DNN-IDS architectures with different depth were tested to study the factors that drive classification. It was observed that despite showing very similar accuracy results, the factors that drove the decisions were different across architectures. This evidences that the qualitative analysis that is enabled through reporting relevant input features is important for the user to make a more informed decision in choosing a DNN-IDS. This online and offline feedback leads to improving the transparency of the DNN-IDS and helps build trust prior to and during deployment.