用可解释AI提升键盘记录器检测准确率,达99.76%。
Towards Trustworthy Keylogger detection: A Comprehensive Analysis of Ensemble Techniques and Feature Selections through Explainable AI
- 融合多种集成学习与特征选择方法优化检测
- 最佳模型AdaBoost达99.76%准确率,近完美分类
- 结合SHAP和LIME实现特征贡献可解释性分析
键盘记录器检测通过监控异常系统行为(如打字延迟)和网络流量模式来识别数据外泄。本研究对传统机器学习模型(SVC、随机森林、决策树、XGBoost、AdaBoost、逻辑回归、朴素贝叶斯)及高级集成方法(堆叠、混合、投票)进行了全面分析,并评估了信息增益、Lasso L1、Fisher评分等特征选择方法以提升预测性能并降低计算复杂度。实验使用公开的Kaggle Keylogger Detection数据集,除准确率外,还采用可解释人工智能(XAI)技术(全局SHAP、局部LIME)分析各特征对检测的贡献。评估指标包括AUC、灵敏度、特异性、准确率和F1分数。最佳结果由使用Fisher评分的AdaBoost模型取得:准确率99.76%,F1得分0.99,精确率100%,召回率98.6%,特异性1.0,AUC为0.99,接近完美分类。
原文摘要 · Abstract (English)
Keylogger detection involves monitoring for unusual system behaviors such as delays between typing and character display, analyzing network traffic patterns for data exfiltration. In this study, we provide a comprehensive analysis for keylogger detection with traditional machine learning models - SVC, Random Forest, Decision Tree, XGBoost, AdaBoost, Logistic Regression and Naive Bayes and advanced ensemble methods including Stacking, Blending and Voting. Moreover, feature selection approaches such as Information gain, Lasso L1 and Fisher Score are thoroughly assessed to improve predictive performance and lower computational complexity. The Keylogger Detection dataset from publicly available Kaggle website is used in this project. In addition to accuracy-based classification, this study implements the approach for model interpretation using Explainable AI (XAI) techniques namely SHAP (Global) and LIME (Local) to deliver finer explanations for how much each feature contributes in assisting or hindering the detection process. To evaluate the models result, we have used AUC score, sensitivity, Specificity, Accuracy and F1 score. The best performance was achieved by AdaBoost with 99.76% accuracy, F1 score of 0.99, 100% precision, 98.6% recall, 1.0 specificity and 0.99 of AUC that is near-perfect classification with Fisher Score.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。