arXiv:2501.16638cs.LGcs.CR2025-01被引 9

用MLP和XAI分析零日攻击检测,提升模型准确率与可解释性。

Analysis of Zero Day Attack Detection Using MLP and XAI

  • 基于KDD99数据集训练四种MLP模型,优化分类性能。
  • 截断模型达99.62%准确率,加权截断模型更均衡地覆盖各类样本。
  • 结合SHAP分析特征重要性,增强模型可解释性,适合安全研究者使用。

零日攻击指利用未知漏洞的攻击行为,其检测需求巨大。本文分析基于机器学习(ML)与深度学习(DL)的入侵检测系统(IDS),并采用可解释AI(XAI)方法,通过测试集随机采样数据训练解释器进行评估。研究聚焦于最常用于零日攻击检测的KDD99数据集,旨在减少类别数量以支持多分类任务,测试ML/DL在模式识别中的表现,验证模型鲁棒性、可靠性、可解释性与可扩展性。对比四种在KDD99上训练的多层感知机(MLP):基准模型、加权模型、截断模型、加权截断模型。结果表明,截断模型准确率达99.62%,精度与召回率最优;加权截断模型准确率97.26%,但各类别表现更均衡,未加权召回率更高。进一步使用SHAP对截断模型训练解释器,分析加权与非加权模型中特征重要性。

原文摘要 · Abstract (English)

Any exploit taking advantage of zero-day is called a zero-day attack. Previous research and social media trends show a massive demand for research in zero-day attack detection. This paper analyzes Machine Learning (ML) and Deep Learning (DL) based approaches to create Intrusion Detection Systems (IDS) and scrutinizing them using Explainable AI (XAI) by training an explainer based on randomly sampled data from the testing set. The focus is on using the KDD99 dataset, which has the most research done among all the datasets for detecting zero-day attacks. The paper aims to synthesize the dataset to have fewer classes for multi-class classification, test ML and DL approaches on pattern recognition, establish the robustness and dependability of the model, and establish the interpretability and scalability of the model. We evaluated the performance of four multilayer perceptron (MLP) trained on the KDD99 dataset, including baseline ML models, weighted ML models, truncated ML models, and weighted truncated ML models. Our results demonstrate that the truncated ML model achieves the highest accuracy (99.62%), precision, and recall, while weighted truncated ML model shows lower accuracy (97.26%) but better class representation (less bias) among all the classes with improved unweighted recall score. We also used Shapely Additive exPlanations (SHAP) to train explainer for our truncated models to check for feature importance among the two weighted and unweighted models.

零日攻击MLPXAI可解释性

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。