The wide adoption of supervised-learning–based network intrusion detection systems is hindered by their reliance on labelled traffic, which is costly to obtain in real-world scenarios. In this work, five unsupervised domain adaptation methods are evaluated in an attempt to alleviate this problem. First, the severity of source-target divergence is quantified on two benchmark datasets(CICIDS2018 and UNSW-NB15 netflow datasets) using Maximum Mean Discrepancy, per-feature Wasserstein distances, and Kolmogorov–Smirnov tests. Next, a common neural-network backbone is trained on the source, and each DA method is used to attempt to bridge the source - target domain gap. Finally, SHAP is used to compare feature-importance patterns before and after adaptation, to assess the DA effect on model decision logic. The results demonstrate that conventional DA methods fail to deliver robust cross-domain NIDS.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

SHAP Insights into Domain Adaptation in Netflow-Based Network Intrusion Detection Powered by Deep Learning

  • Marek Pawlicki,
  • Sebastian Szelest,
  • Rafal Kozik,
  • Michał Choraś

摘要

The wide adoption of supervised-learning–based network intrusion detection systems is hindered by their reliance on labelled traffic, which is costly to obtain in real-world scenarios. In this work, five unsupervised domain adaptation methods are evaluated in an attempt to alleviate this problem. First, the severity of source-target divergence is quantified on two benchmark datasets(CICIDS2018 and UNSW-NB15 netflow datasets) using Maximum Mean Discrepancy, per-feature Wasserstein distances, and Kolmogorov–Smirnov tests. Next, a common neural-network backbone is trained on the source, and each DA method is used to attempt to bridge the source - target domain gap. Finally, SHAP is used to compare feature-importance patterns before and after adaptation, to assess the DA effect on model decision logic. The results demonstrate that conventional DA methods fail to deliver robust cross-domain NIDS.