An Interpretable Network Intrusion Detection Model via Decision Tree Enhanced Deep Attention Network

Network intrusion detection (NID) plays a crucial role in cybersecurity by identifying network attacks from network traffic. In recent years, the deep learning technique has become a tendency for the NID problem. However, a major drawback of deep learning is the lack of interpretability, making NID systems (NIDSs) difficult to diagnose and response to the detected network attacks. At the same time, the existing interpretable deep learning techniques cannot adapt to the NID problem due to its specific challenges, including the cross‐feature effect and the absence of self‐interpretable features. To this end, this article proposes a decision Tree enhanced deep Attention Network (TAN), an interpretable deep learning model specifically designed for the NID problem by integrating a decision tree (DT) into a deep attention network. TAN utilizes a DT to extract self‐interpretable features and then uses a deep hierarchical attention network to capture the cross‐feature effect and pinpoint the most important self‐interpretable features. A series of experiments and case studies were performed on public datasets, including KDD99, NSL‐KDD, UNSW‐NB15, and CICIDS2017. The results indicate that TAN achieves competitive detection performance compared to existing deep learning models, while offering a more intuitive interpretation.