Explainability-based Metrics to Help Cyber Operators Find and Correct Misclassified Cyberattacks - IMT Atlantique Accéder directement au contenu
Communication Dans Un Congrès Année : 2023

Explainability-based Metrics to Help Cyber Operators Find and Correct Misclassified Cyberattacks

Résumé

Machine Learning (ML)-based Intrusion Detection Systems (IDS) have shown promising performance. However, in a human-centered context where they are used alongside human operators, there is often a need to understand the reasons of a particular decision. EXplainable AI (XAI) has partially solved this issue, but evaluation of such methods is still difficult and often lacking. This paper revisits two quantitative metrics, Completeness and Correctness, to measure the quality of explanations, i.e., if they properly reflect the actual behaviour of the IDS. Because human operators generally have to handle a huge amount of information in limited time, it is important to ensure that explanations do not miss important causes, and that the important features are indeed causes of an event. However, to be more usable, it is better if explanations are compact. For XAI methods based on feature importance, Completeness shows on some public datasets that explanations tend to point out all important causes only with a high number of features, whereas Correctness seem to be highly correlated with prediction results of the IDS. Finally, besides evaluating the quality of XAI methods, Completeness and Correctness seem to enable identification of IDS failures and can be used to point the operator towards suspicious activity missed or misclassified by the IDS, suggesting manual investigation for correction.
Fichier principal
Vignette du fichier
SAFE_Workshop.pdf (512.55 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-04484785 , version 1 (01-03-2024)

Identifiants

Citer

Robin Duraz, David Espes, Julien Francq, Sandrine Vaton. Explainability-based Metrics to Help Cyber Operators Find and Correct Misclassified Cyberattacks. CoNEXT 2023: The 19th International Conference on emerging Networking EXperiments and Technologies, Dec 2023, Paris, France. ⟨10.1145/3630050.3630079⟩. ⟨hal-04484785⟩
8 Consultations
7 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More