Rigorous Explainable Algorithm of Neural Network in Intrusion Detection

Current cyber intrusion detection depends heavily on neural networks machine learning algorithms, however, neural network models are opaque and fragile, trivial disturbances on the inputs can cause the model flip its decision without any explanations. For the intrusion detection decision made by neural network models to be trustworthy, formal explanation methodologies for neural network driven intrusion detections are imperative. Prime implicant (PI) explanations are able to provide logic sufficient and accuracy guaranteed explanations for a neural network. However, extracting PI explanations is a NP-hard problem. In this paper, by converting the neural network model as a game, we propose an methodology to extract formal explanations out of the neural network intrusion detection model within tractable complexity. We apply the algorithms on real-life intrusion datasets, and show how the representation methodology allow us to represent a neural network model with hundreds of neurons as a two-player game, and extracting the formal explanations that are guaranteed to be accurate within 0.0001 seconds on average. The formal explanations extracted from the neural network model with <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\text{AUC} \geqslant 0.8$</tex> are demonstrated as rules for intrusion detection. It is evident that the algorithm is practical and scalable.