Research on Intrusion Detection Based on Interpretable Machine Learning

Intrusion Detection Systems (IDS) grapple with challenges such as delayed updates and a high false positive rate in traditional rule-based approaches under high-dimensional network traffic data. Although deep learning has significantly improved detection accuracy, the conflict between its "black box" nature and traceability requirements still persists. This paper focuses on port scanning attack detection and provides a “dual-wheel-driven” solution of "architecture optimization and interpretability enhancement" to build a high-precision interpretable learning framework. To tackle the vanishing gradient and overfitting problems of traditional Deep Neural Networks (DNN), an enhanced DNN model architecture is designed: through dynamic residual structure, "expansion-compression" design, and adaptive regularization strategy, the learning ability of high-dimensional network traffic features is improved. Moreover, to address the common "black-box" problem in current models, this paper introduces a feature importance quantification method based on gradient-weighting, which integrates dynamic prediction confidence weights to enhance the interpretability analysis of model decisions. In this study, the CICIDS-2017 dataset is chosen for training and evaluation. The results indicated that the enhanced DNN model had significantly better accuracy on the test set than traditional DNN and traditional machine learning models. More importantly, the enhanced DNN model can also identify key attack features, providing high-precision and transparent methodological support for cybersecurity defense.