xIIRS: Industrial Internet Intrusion Response Based on Explainable Deep Learning

The extensive interconnection and intelligent collaboration of multi-source heterogeneous devices in the industrial Internet environment have significantly improved the efficiency of industrial production and resource utilization. However, at the same time, the deployment characteristics of open-network architecture and the promotion of the concept of deep integration of OT/IT have led to an exponential growth of attacks on the industrial Internet. At present, most of the detection methods for industrial internet attacks use deep learning. However, due to the black-box characteristics caused by the complex structure of deep learning models, the explainability of industrial internet detection results generated based on deep learning is low. Therefore, we proposed an industrial internet intrusion response method xIIRS based on explainable deep learning. Firstly, an explanation method was improved to enhance the explanation by approximating and sampling the historical input and calculating the dynamic weighting for the sparse group lasso based on the evaluation criteria for the importance of features between and within feature groups. Then, we determined the defense rule scope based on the obtained explanation results and generated more fine-grained defense rules to implement intrusion response in combination with security constraints. The proposed method was experimented on two public datasets, TON_IoT and Gas Pipeline. The experimental results show that the explanation effect of xIIRS is better than the baseline method while achieving an average malicious traffic blocking rate of about 95% and an average normal traffic passing rate of about 99%.