用可解释的特征筛选提升检测高级威胁的准确率
An explainable Recursive Feature Elimination to detect Advanced Persistent Threats using Random Forest classifier
- 结合递归特征消除与随机森林，自动筛选关键特征
- 在CICIDS2017数据集上实现99.9%检测准确率
- 通过SHAP值解释特征贡献，适合安全审计场景
入侵检测系统（IDS）在现代网络安全框架中扮演关键角色，是抵御复杂威胁行为者的主要防线。本文提出一种可解释的入侵检测框架，将递归特征消除（RFE）与随机森林（RF）结合，以增强对高级持续性威胁（APTs）的检测能力。基于CICIDS2017数据集，该方法首先进行全面的数据预处理，再通过RFE筛选出最具代表性的特征。随后，在精炼特征集上训练随机森林模型，并使用SHapley Additive exPlanations（SHAP）分析各特征的贡献。实验表明，该可解释的RF-RFE方法实现了99.9%的检测准确率，相比传统分类器显著降低误报率和计算开销。研究结果验证了可解释AI与特征选择融合的有效性，为构建鲁棒、透明且可部署的IDS提供了新思路。
原文摘要 · Abstract (English)
Intrusion Detection Systems (IDS) play a vital role in modern cybersecurity frameworks by providing a primary defense mechanism against sophisticated threat actors. In this paper, we propose an explainable intrusion detection framework that integrates Recursive Feature Elimination (RFE) with Random Forest (RF) to enhance detection of Advanced Persistent Threats (APTs). By using CICIDS2017 dataset, the approach begins with comprehensive data preprocessing and narrows down the most significant features via RFE. A Random Forest (RF) model was trained on the refined feature set, with SHapley Additive exPlanations (SHAP) used to interpret the contribution of each selected feature. Our experiment demonstrates that the explainable RF-RFE achieved a detection accuracy of 99.9%, reducing false positive and computational cost in comparison to traditional classifiers. The findings underscore the effectiveness of integrating explainable AI and feature selection to develop a robust, transparent, and deployable IDS solution.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。