Eclectic Rule Extraction for Explainability of Deep Neural Network based
  Intrusion Detection Systems
Jesse Ables Nathaniel Childers William Anderson Sudip Mittal Shahram Rahimi Ioana Banicescu Maria Seale
This paper addresses trust issues created from the ubiquity of black box
algorithms and surrogate explainers in Explainable Intrusion Detection Systems
(X-IDS). While Explainable Artificial Intelligence (XAI) aims to enhance
transparency, black box surrogate explainers, such as Local Interpretable
Model-Agnostic Explanation (LIME) and SHapley Additive exPlanation (SHAP), are
difficult to trust. The black box nature of these surrogate explainers makes
the process behind explanation generation opaque and difficult to understand.
To avoid this problem, one can use transparent white box algorithms such as
Rule Extraction (RE). There are three types of RE algorithms: pedagogical,
decompositional, and eclectic. Pedagogical methods offer fast but untrustworthy
white-box explanations, while decompositional RE provides trustworthy
explanations with poor scalability. This work explores eclectic rule
extraction, which strikes a balance between scalability and trustworthiness. By
combining techniques from pedagogical and decompositional approaches, eclectic
rule extraction leverages the advantages of both, while mitigating some of
their drawbacks. The proposed Hybrid X-IDS architecture features eclectic RE as
a white box surrogate explainer for black box Deep Neural Networks (DNN). The
presented eclectic RE algorithm extracts human-readable rules from hidden
layers, facilitating explainable and trustworthy rulesets. Evaluations on
UNSW-NB15 and CIC-IDS-2017 datasets demonstrate the algorithm's ability to
generate rulesets with 99.9% accuracy, mimicking DNN outputs. The contributions
of this work include the hybrid X-IDS architecture, the eclectic rule
extraction algorithm applicable to intrusion detection datasets, and a thorough
analysis of performance and explainability, demonstrating the trade-offs
involved in rule extraction speed and accuracy.