用合成数据训练可解释的入侵检测模型，让结果可追溯、可复现、法庭可用。
Forensic-Oriented Intrusion Detection Using Synthetic Network Traffic Data and Explainable Artificial Intelligence
- 用合成数据替代原始证据训练，确保证据不被污染。
- 在真实数据上测试达F1值0.96，接近真实训练基线。
- 生成的解释能对应具体网络行为，适合用于法庭作证。
网络入侵数字取证要求分析结果可追溯、可复现且具备法庭可采信性，而现有机器学习流程因直接使用原始证据作为训练数据，并生成缺乏实例级解释的黑箱分类，无法满足此要求。本文提出一种面向取证的入侵检测框架，通过集成合成数据生成、二分类与可解释性，在单一流程中同时解决上述问题，遵循ISO/IEC 27037、27041、27042及NIST SP 800-86标准。原始数据作为不可变、哈希验证的证据；所有训练基于参数化合成数据（采用SDV + CTGAN）进行。XGBoost二分类在表格型网络流数据上表现优异，SHAP TreeExplainer提供实例级特征归因，将统计预测映射至可观测网络行为，便于生成取证报告。在CICIDS2017上采用Train-on-Synthetic, Test-on-Real（TSTR）评估，获得F1-macro = 0.96，与真实数据基线（0.97）在交叉验证方差内一致。Kolmogorov-Smirnov检验表明合成数据隐私保护有效（均值|KS| = 0.38），同时保持操作有效性。跨数据集验证在UNSW-NB15和Kitsune中确认特征空间维度是合成训练有效性的主要决定因素，设定约30个数值型流级特征为实际部署边界。针对暴力破解、端口扫描和拒绝服务攻击的SHAP归因在真实与合成实例间具有一致性，证实合成训练保留了专家证词所需的攻击指纹。
原文摘要 · Abstract (English)
Digital forensic investigations of network intrusions require analytical outputs that are traceable, reproducible, and court-defensible - requirements existing machine learning pipelines do not satisfy, since they treat original evidence as training data and produce opaque classifications without instance-level justification. This paper presents a forensic-oriented intrusion detection framework resolving both problems simultaneously, integrating synthetic data generation, binary classification, and explainability within a single pipeline governed by ISO/IEC 27037, 27041, 27042, and NIST SP 800-86. The framework operationalises the ISO/IEC 27037 requirement for strict separation between original digital evidence and derived analytical artefacts. Original datasets are treated as immutable, hash-verified artefacts; all training operates on parameterized synthetic derivatives via SDV + CTGAN. XGBoost binary classification provides high-performance detection on tabular network flow data, and SHAP TreeExplainer produces instance-level feature attributions mapping statistical predictions to observable network behaviour for forensic reporting. Train-on-Synthetic, Test-on-Real (TSTR) evaluation on CICIDS2017 achieves F1-macro = 0.96, within cross-validation variance of the real-data baseline (0.97). Kolmogorov-Smirnov testing confirms synthetic privacy preservation (mean |KS| = 0.38) alongside operational utility. Cross-dataset validation on UNSW-NB15 and Kitsune identifies feature space dimensionality as the primary determinant of synthetic training effectiveness, establishing a practical deployment boundary of approximately 30 numeric flow-level features. SHAP attributions for Brute Force, Port Scan, and DoS attacks are consistent across real and synthetic instances, confirming synthetic training preserves forensically relevant attack fingerprints required for expert witness testimony.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。