Enhancing Anomaly Based IDS for IOT through XAI

Abstract

Anomaly detection is a challenging task. Anomalies are deviant behavior from the normal pattern. However, unsupervised anomalies are mostly validated by domain experts. All-time experts are not available, and manually checking takes a lot of time and costs. The anomaly detected through various Machine learning(ML) and Deep Learning(DL) models lacks explainability and a trace that led to their identification. Therefore, a scheme is required that can overcome these limitations and improve the interpretability of the detections. We use Unsupervised Algorithms, isolation forest (IF), and local outlier factor(LOF) to identify anomalies in the Electronic Patient Record (EPR) dataset and validate the clustering quality through the Dunn index and Silhouette score. Furthermore, Explainable AI (XAI) techniques, such as Lime and Shap, are utilized that visually explain the cause of the anomaly according to feature contribution without experts, and for user-friendly explainable captions are generated on each instance of anomaly so non-technical users can easily understand the result of Lime and Shap. Three metrics, fidelity, sparsity, and stability, are used to validate the explanation layer, which explains each instance of anomaly where fidelity is R2 ≥ 0.70, sparsity prefers where less number of features provide user-friendly results, and high stability. Finally, a Lime-Shap agreement is done to validate the result on each instance of anomaly and achieve near forty percent (∼40%) similar results when applied on all Explanations(all seeds) and greater than fifty percent (> 50%) when a smaller number of features (k=3) is used to make explanations simple and accurate.