# Explainable Intrusion Detection Systems Using Competitive Learning
Techniques

Jesse Ables  Thomas Kirby  Sudip Mittal  Ioana Banicescu  Shahram Rahimi
William Anderson  Maria Seale

###### Abstract

The current state of the art systems in Artificial Intelligence (AI) enabled
intrusion detection use a variety of black box methods. These black box
methods are generally trained using Error Based Learning (EBL) techniques with
a focus on creating accurate models. These models have high performative costs
and are not easily explainable. A white box Competitive Learning (CL) based
eXplainable Intrusion Detection System (X-IDS) offers a potential solution to
these problem. CL models utilize an entirely different learning paradigm than
EBL approaches. This different learning process makes the CL family of
algorithms innately explainable and less resource intensive. In this paper, we
create an X-IDS architecture that is based on DARPA’s recommendation for
explainable systems. In our architecture we leverage CL algorithms like, Self
Organizing Maps (SOM), Growing Self Organizing Maps (GSOM), and Growing
Hierarchical Self Organizing Map (GHSOM). The resulting models can be data-
mined to create statistical and visual explanations. Our architecture is
tested using NSL-KDD and CIC-IDS-2017 benchmark datasets, and produces
accuracies that are 1% - 3% less than EBL models. However, CL models are much
more explainable than EBL models. Additionally, we use a pruning process that
is able to significantly reduce the size of these CL based models. By pruning
our models, we are able to increase prediction speeds. Lastly, we analyze the
statistical and visual explanations generated by our architecture, and we give
a strategy that users could use to help navigate the set of explanations.
These explanations will help users build trust with an Intrusion Detection
System (IDS), and allow users to discover ways to increase the IDS’s potency.

###### keywords:

Artificial Intelligence , Intrusion Detection , Explainability , Cyber
Security , Explainable Intrusion Detection , Competitive Learning

[MSU]organization=Mississippi State University, Department of Computer Science
and Engineering,state=Mississippi, country=USA

[ERDC]organization=U.S. Army Engineer Research and Development
Center,city=Vicksburg, state=Mississippi, country=USA

##  1 Introduction

Shifting away from the current trend of black box Intrusion Detection Systems
(IDS) can lead to more trustable and credible anomaly detection. Existing
methods for AI enabled intrusion detection use Error Based Learning (EBL)
algorithms to detect anomalies. EBL refers to models that train through
minimizing a loss function, generally through the gradient descent algorithm.
These models can achieve high detection rates, however they suffer from a few
problems. First, these techniques can impose high performative cost. Neural
networks can require both high amounts of time and memory to train [1, 2].
Second, many of these methods have high false positive rates which can harm
the overall performance of a real-world IDS [3]. Lastly, these models are not
easy to understand and are not innately explainable. Users who use these
opaque models do not know how or why a prediction was computed. This can cause
a lack of trust and prevent the adoption of AI IDS solutions [4, 5].

eXplainable Intrusion Detection Systems (X-IDS) are a potential solution to
the above mentioned problems [1]. To begin, the Defence Advanced Research
Projects Agency (DARPA) defines an explainable system as an AI that can
explain the reasoning for its decisions, characterize its strengths and
weaknesses, and convey a sense of its future behavior [6]. There are many
methods that can allow current EBL AI models to achieve these tenets.
Solutions such as Local Interpretable Model-agnostic Explanations (LIME) [7],
SHapely Additive exPlantions (SHAP) [8], and Layer-wise Relevance Propagation
(LRP) [9] have the ability to convert black box models into semi-transparent,
explainable models. However, the use of these types of solutions comes with
downsides and a large performance overhead. Creating surrogate models can be a
time consuming and resource intensive process. On the otherhand, white box
Competitive Learning (CL) algorithms do not need a surrogate model to be
trained since they are innately explainable. Being white boxes, these already
transparent algorithms are easy to understand and allow for customizable
explanations to be generated. White box CL algorithms are able to meet all of
the criteria DARPA has set for explainable systems, and are a good choice for
an X-IDS.

Competitive learning algorithms differ from the more popular EBL algorithms in
a number of ways. Where EBL algorithms, such as deep neural networks and
recurrent neural networks, learn by adjusting weights to minimize loss, CL
algorithms learn through a competitive process. These CL based techniques, for
instance, pits nodes that mimic samples of data against one another. When a
node wins in this competition, its weights are adjusted to be similar to the
training sample. This enables CL-based techniques to learn by creating
abstract representations of data. For IDS datasets, an X-IDS system built
using CL models can learn different kinds of attacks and benign behaviors. An
important benefit to this type of learning is its ability to be data-mined for
visual and statistical explanations. This is a benefit that EBL algorithms
lack. See Section 4.4 for more information about CL explanations.

The most ubiquitous CL algorithm one will find is the Self Organizing Map
(SOM) [10] and its variants. These algorithms consist of a grid of
orthogonally connected nodes that each contain a representation of data. As
mentioned previously, these nodes compete against one another to mimic
abstract patterns in data. The original SOM algorithm consists of a static map
of nodes that confine the training area. The Growing Self Organizing Map
(GSOM) [11] and Growing Hierarchical Self Organizing Map (GHSOM) [12] improve
upon the original SOM design by growing the map horizontally and vertically.
These expansion strategies allow the improved algorithms to learn various
abstract representations of data than the original SOM. These algorithms are
detailed further in Section 3.

There are many benefits to using CL algorithms for an X-IDS. Users of an IDS
can use CL models to formulate better responses for tasks they must perform.
Security analysts can use the model’s explanations to better understand
attacks in order to better protect their network. Machine learning engineers
may also be able to discover deficiencies in the model’s logic. Using this
knowledge, they can modify the architecture or introduce new training samples
to increase its overall effectiveness. Explanations will also lead to
increasing the IDS’s trust and credibility. This can make users more confident
that they will be able to complete their tasks.

In this paper, we detail our customizable X-IDS architecture that leverages CL
algorithms to create explanations and accurate predictions. The architecture
consists of four phases: Pre-modeling, Modeling, Post-Modeling Optimizations,
and Prediction Explanation. Users are encouraged to modify the architecture
when they receive explanations that are not helpful. We then compare the
accuracy of the CL models used in our X-IDS architecture to other EBL models
and discuss explanations generated by the SOM, GSOM, and GHSOM. We find that
our models are 1% - 3% less accurate than black box EBL models, however, CL
models are far more explainable.

Major contributions presented in this paper are -

  * 1.

An X-IDS architecture featuring three CL-based algorithms, built using DARPA’s
guidelines for an explainable system. Self-Organizing Map, Growing Self
Organizing Map, and Growing Hierarchical Self Organizing Map models are used
to create explanatory visualizations and accurate predictions. We find that CL
models are 1% - 3% less accurate than EBL models, but CL algorithms are more
explainable.

  * 2.

An analysis of statistical and visual explanations for an effective X-IDS. Our
X-IDS architecture generates a collection of explainable visualizations
ranging from global significance charts to fine-grained feature explanations.
Users can use these explanations to understand how and why the model makes
decisions.

  * 3.

A pruning process that can significantly reduce the size of the GHSOM model.
The GHSOM algorithm can create more maps than a human can have time to
understand. Additionally, larger maps can impose a higher performative cost.
The pruning process is able to remove less important branches to improve
overall prediction speed while losing little accuracy.

  * 4.

A performative analysis of our architecture using traditional accuracy
metrics. We compare CL models to existing EBL models using the NSL-KDD and
CIC-IDS-2017 datasets. CL models are 1% - 3% less accurate than EBL
algorithms. Even though they are less accurate, their explainability makes CL
algorithms an important tool for X-IDSs.

The rest of the paper is outlined as follows - In Section 2, we discuss
background on IDS, XAI, and X-IDS. Section 3 describes the CL-based algorithms
used in this paper and contrasts the CL and EBL techniques. Section 4,
outlines our CL based X-IDS with its architecture presented in Figure 1.
Section 5 discusses our experimental results. Finally, the conclusion and
future work has been discussed in Section 6.

##  2 Background on Intrusion Detection and Explainability

Intrusion detection has long been an area where black box models are applied
to detect intrusions/anomalies. These black box models tend to boast high
detection rates, however, a major issue is their poor explainability.
Therefore, the area of intrusion detection can heavily benefit from
explanations. In the following subsections, we provide a brief background on
Intrusion Detection Systems (IDS), Explainable Artificial Intelligence Systems
(XAI), and Explainable Intrusion Detection Systems (X-IDS).

###  2.1 Intrusion Detection Systems (IDS)

An intrusion refers to an action that obtains unauthorized access to a network
or system [13]. An Intrusion Detection System (IDS) consists of tools,
methods, and resources that help a Cyber Security Operation Center (CSoC)
protect an organization by detecting an intrusion [14, 15]. IDS can be
categorized into operation-based classes, such as signature, anomaly, and
hybrid. Signature-based IDS operate by preventing known attacks from accessing
a network. The IDS compares incoming network traffic to a database of known
attack signatures. Notably, this method has difficulty in preventing zero-day
attacks [16]. Anomaly-based IDSs look for patterns in incoming traffic to
recognize potential threats and leverage complex AI models [17, 18, 1]. A
significant drawback of this approach is the tendency for such systems to
categorize legitimate, unseen behavior as anomalous. Hybrid-based IDS
incorporates the design philosophy of both signature-based and anomaly-based
IDS to improve the detection rate while minimizing false positives [19, 20].

Current work on AI enabled anomaly-based IDS can be further divided into black
box and white box models [1]. White box models are considered easy to
understand by an expert. This allows the expert to analyze the decision
process and understand how the model renders its decision. This (semi-)
transparent property allows white box models to be deployed in decision
sensitive domains, where auditing the decision process is a requirement. White
box models may use regression-based approaches [21], decision trees [22], and
Self Organizing Maps (SOMs) [23]. Black box models, on the other hand, have an
opaque decision process. This opaqueness property makes establishing the
relationship between inputs and the decision difficult, if not outright
impossible. Black box models comprise nearly all the AI enabled state-of-the-
art approaches for IDS, as the focus is traditionally on model performance,
not explainability. Examples of popular black box model techniques are
Isolation Forest [24], One-Class SVM [25], and Neural Networks [26].

As previously stated, state-of-the-art approaches for IDS, as well as machine
learning as a whole, focus on model performance through the lens of model
accuracy. This focus on model accuracy has driven the development further away
from modeling approaches that are transparent or have methods of
explainability. In turn, this creates a separation between model inference and
the understanding of model inference, which gives the inability to confirm
model fairness, privacy, reliability, causality, and ultimately trust.

###  2.2 Explainable Artificial Intelligence Systems (XAI)

The notion of an Explainable Artificial Intelligence system (XAI) dates back
to the 1970s. Moore et al. [27] surveyed works from the 1970s to the 1980s,
detailing early methods of explanations. Some early explanations consisted of
canned text and code translations, such as the 1974 explainer MYCIN [28]. We
can find a more current definition of XAI by the Defense Advanced Research
Projects Agency (DARPA) [6]. DARPA defines XAI as ‘systems that are able to
explain their reasoning to a human user, characterize their strengths and
weaknesses, and convey a sense of their future behavior’. An XAI system that
follows this definition offers some form of justification for its action,
leading to more trust and understanding of the system. The explanations from
an XAI system help the user not only in using and maintaining the AI model but
also helping users complete tasks in parallel with the AI system. Tasks can
include doctors making medical decisions [28, 29, 30], credit score decisions
[31], detecting counterfeit banknotes [32], advance maintenance [33], or CSoC
operators defending a network [6, 34, 5].

The current literature consists of many different black box models being used
alongside explanation techniques. Common explainer modules for black box
models are Local Interpretable Model-agnostic Explanations (LIME) [7], SHapely
Additive exPlantions (SHAP) [8], and Layer-wise Relevance Propagation (LRP)
[9]. Modern techniques for explaining black box models consist of creating
surrogate models that generate explanations either locally or globally. Other
methods involve propagating predictions backward in a neural network or
decomposing a gradient. More novel approaches have also experimented with
making datasets explainable [35] or making graphical user interfaces for
explainable systems [36].

###  2.3 Explainable Intrusion Detection Systems (X-IDS)

Explainable Intrusion Detection Systems are still an emerging sub-genre. The
need for explainability in IDS is becoming increasingly necessary. In decision
sensitive domains, black boxes obfuscate the decision making process causing a
lack of trust in predictions. The users need to be confident in the
predictions or recommendations computed by an IDS. Understandable explanations
allow users to perform their tasks correctly. The stakeholders of an IDS (e.g.
CSoC operators, developers, and investors) are individuals who will be
dependent on the performance of the system [1]. CSoC operators will be
performing defense actions based on prediction and explanation results.
Developers can use explanations to fortify the model in areas where it is
weak. Investors may need explanations to help them make their company’s
budgeting decisions.

There are many examples of X-IDS being used in research today. A survey by
Neupane et al. [1] describes in detail different X-IDS systems. Many black box
implementations have been shown using libraries such as SHAP, LIME, or LRP
[37, 38, 39]. There have also been more original explanation frameworks, such
as one that involves using the CIA triad to generate explanations [35]. On the
other hand, white box models have also been used to create strong X-IDS
architectures. Notable entries have created explainable decision trees and
linear regression models [22, 21]. In our previous work [5], we created a
proof-of-concept X-IDS architecture that uses a Self Organizing Map (SOM). The
architecture, based on DARPA’s recommendation [6], is meant to be a good
starting point for developing explainable IDS systems. Additionally, we
demonstrate that the white box SOM algorithm is both more explainable and is
comparably accurate to black box models. Both black box and white box methods
have proved effective in detecting attacks. However, we believe that the
inherently explainable Competitive Learning (CL) based methods are the way
forward for future X-IDS.

##  3 Background on Competitive Learning (CL) based Algorithms

In this section, we briefly describe the theoretical and practical aspects of
Competitive Learning (CL) algorithms. CL covers a range of algorithms wherein
parts of the model compete against one another to represent one aspect of a
dataset. This is opposed to a different method of training models known as
Error Based Learning (EBL). In the following section, we discuss Competitive
Learning (CL) and how it compares to Error Based Learning (EBL). We detail
various CL based intrusion detection systems in current works. Lastly, we
explain the algorithms that we use in our experimentation.

###  3.1 Error Based Learning vs. Competitive Learning

Neural network training algorithms can be divided into a few categories. One
of the most popular categories is Error Based Learning (EBL). The core
principle behind EBL is optimization. EBL models are trained through a process
known as Empirical Risk Minimization (ERM). Through this process, the Machine
Learning (ML) algorithm works to minimize a parameter known as ‘loss’, which
is a metric that measures how poorly a model predicted a specific sample. If
the model is correct, loss is given a value of 0, otherwise, loss will be a
value greater than 0. Common loss functions include Binary Cross Entropy, Mean
Absolute Error, and Poisson. To make use of the loss function, ML algorithms
employ an ERM technique. Gradient Descent (GD) is one of the most well known
techniques for this purpose. GD works by calculating the slope or gradient at
a given point of a loss function. Normally, this strategy is applied to convex
functions, but ML applications are rarely so orderly. After calculating the
gradient, GD then takes a step down the slope. A step can be done for every
training sample or a batch of training samples. This changes the weights and
biases of a neural network in an effort to lower the loss. This process
repeats until the algorithm has converged as close as possible to 0.

The next set of algorithms that can be used is Competitive Learning (CL). CL
consists of unsupervised algorithms where nodes compete with one another over
the right to activate for input data. There are also a few variants of these
algorithms that use probabilistic methods rather than neural networks. CL
algorithms follow three tenets [40]: (i) all units are the same at the start
except for their randomly selected weights, (ii) the ‘strength’ of each unit
is limited, and (iii) units compete to represent a sub-set or ‘cluster’ of the
input data. Using these tenets, nodes in a CL algorithm can represent abstract
patterns or features in data. Nodes compete by being closer to the input data.
Generally, this is calculated through euclidean distance. The randomly
selected weights are then adjusted to be closer to the input data. There are a
few common algorithms that implement this tactic: SOMs, K-Means Clustering,
and Expectation-Maximization (EM) mixture modeling [41].

One can already begin to see the difference between CL and EBL. Neurons in EBL
algorithms represent an activation function rather than mimicking input data.
EBLs train towards the goal of minimizing loss from these activation
functions. On the other hand, the nodes of CL algorithms contain a vector that
is similar to the input data. Training these nodes allow these algorithms to
slowly converge toward the inputted samples. Another major difference between
these two learning styles is their supervised/unsupervised nature. Many EBLs
require a supervised based learning style such that their loss function can be
calculated. However, CL algorithms are able to be trained in an unsupervised
manner. Data labels are not needed during the training process. Another
advantage for CL based methods is that they tend to be inherently explainable.
Since the model works to represent clusters in training data, the model can be
data-mined for various visual and statistical explanations. The same cannot be
said for many EBL methods. As mentioned in a previous section, frameworks such
as SHAP [8] or LIME [7] may be required to make EBL neural networks
explainable. Lastly, the two algorithm sets predict data differently. EBL
algorithms predict data using a loss threshold that causes neuron activation
while CL predicts based on proximity.

Generating explanations for EBL and CL algorithms also differ. EBL algorithms
are categorically known as black box algorithms. It is difficult to discern
what process the algorithm took to create predictions. To remedy this, one can
use a surrogate model method such as Local Interpretable Model-agnostic
Explanations (LIME) [7], SHapely Additive exPlantions (SHAP) [8], and Layer-
wise Relevance Propagation (LRP) [9]. These surrogate models create
explanations generally through processes such as perturbation or probabilistic
set theory. There are two major problems with using these approaches. First,
the use of these algorithms is effectively using a black box to explain a
black box. The process for generating the explanations can be difficult to
understand, so it may be more difficult for users to trust the explanations.
Secondly, surrogate generators can be computationally expensive. Not only does
one need to train a model, they must then train a surrogate model afterwards.
CL algorithms remedy these problems. Since the algorithms are already white
box, they can easily be explained. Users can create their own custom
explanations that they can trust. Additionally, the computational complexity
is generally limited by the size of the CL algorithm’s map of nodes.

###  3.2 Competitive Learning used in Intrusion Detection

Figure 1: A competitive learning based X-IDS architecture. The architecture is
divided into four phases: Pre-Modeling, Modeling, Post-Modeling Optimization,
and Prediction Explanation. Each phase contributes to translating raw input
data into accurate predictions and useful explanations. Culminating in a user
successfully completing an associated task or being required to make changes
to previous steps in the architecture.

In the past, CL algorithms have been used to create many IDS. These studies
focused on building accurate IDS and did not discuss explainability. Among
these approaches, SOMs were used to create both host-based [42] and network-
based [43, 44, 45] IDS. The majority of these methods simply trained a SOM
based IDS and illustrated mappings between data points and the associated Best
Matching Unit (BMU). The approaches described in [46, 45] use multiple SOMs in
conjunction with one another to create a more effective IDS. Only one approach
[43] discussed the false positive rate and accuracy of a SOM-based IDS. Their
method for prediction involved assigning a label to BMUs based on the training
dataset. Using this approach meant that not all SOM units were assigned a
label. The authors utilized Gaussian Mixture Modeling (GMM) to make
predictions when a testing sample was similar to an unlabeled unit. In our
previous work [5], we created an X-IDS architecture based on DARPA’s
recommended architecture. One of its main features is having user input for
correcting or modifying the model or its explanations. Using this
architecture, we were able to achieve an accuracy of 91% on NSL-KDD and 80% on
CIC-IDS-2017.

In addition, we can look at instances of GSOM-based IDS. A multi-agent GSOM
proposed by Palomo et al. [47] was created with the goal of being more
accurate on datasets with many different attack types. The Growing SOM should
be able to continuously grow as it discovers new attack types. Their IDS was
able to achieve a 90% accuracy and a 1% false positive rate on the KDD CUP
1999 dataset using 38 different attacks. A novel GSOM algorithm was developed
in [48] and called Statistics-Enhanced Direct Batch Growth Self-Organizing Map
(SE-DBGSOM). One of the goals of using this updated algorithm is to improve
the efficiency of inserting new nodes. The authors note that their algorithm
improves upon previous GSOMs by reducing the number of ‘unnecessary’ nodes.
This improves both runtime and false positive rates. SE-DBGSOM was able to
achieve a greater than 99% accuracy on KDD99 and CICIDS2017 datasets with
false positive rates as low as .6%.

GHSOMs have also made an impact in the field of IDS. One inspiring work that
created a GHSOM IDS is from the authors Ippoliti et al. [49]. They create an
Adaptive GHSOM (A-GHSOM) that uses dynamic normalization scaling, an adaptive
growth thresholds, and confidence filtering for reducing inconsistent
predictions. We can find other works that make other modifications like adding
new metrics for numeric and symbolic data [50], enhancing map initialization
and weight distribution [51], and changing growing conditions [52]. Many of
these implementations were testing using KDD CUP 1999 or NSL-KDD to great
effect.

The final two methods for CL algorithms, EM mixture modeling and K-means
clustering, have also been used to create effective intrusion detection
systems. Both Bahrolo et al. [53] and Hammad et al. [54] have created EM
mixture model IDS that attempt to categorize the different attacks in IDS
datasets. Another work uses a combination of decision trees and EM mixture
modeling to create an effective IDS with an accuracy of 94.2% on the NSL-KDD
dataset[55]. There are a few notable works that use K-means clustering or an
ensemble featuring K-means to categorize or predict anomalies. Two methods
combine K-means with a Naive Bayes classifier to achieve high detection rates
on KDD’99 and ISCX 2012 [56, 57]. In Li et al. [58], their IDS using solely
K-means clustering records a detection rate of 82% on the KDD’99 dataset.

In this work, we focus on the SOM family of CL algorithms. These innately
explainable algorithms have been shown in previous works to be highly accurate
for intrusion detection. Their simple-to-understand nature is conducive to
obtaining great explainable algorithms. In addition, the weights generated by
the SOM algorithms are easily visualized for explanations. In the following
sections, we describe in detail how each of the SOM algorithms operates.

###  3.3 Self-Organizing Maps

Self Organizing Maps (SOMs), sometimes referred to as Kohonen Maps [10, 59],
Kohonen Self Organizing Maps [60], or Kohonen Networks [61], are a class of
unsupervised machine learning algorithms. SOMs are comprised of a network of
individual nodes, each of which has a feature vector of the same size as the
dimension of training data. Some implementations also include a (x,y)
coordinate to allow node movement in a two-dimensional (2D) space. This 2D
space is typically represented as a square or a hexagonal grid, to easily
visualize the represented space.

Algorithm 1 POPSOM Algorithm

0: Rows (n), Columns (m), Learning Rate (LR), Total Epochs (T)

0: Weights (W) BEGIN

Allocate n * m element array W

for each node in W do

Allocate N element array with random values [0,1]

end for

for Each Training Epoch in T do

Pick a training sample

Find Best Matching Unit using Euclidean Distance

Update BMU elements: $w_{i}=w_{i}-\lambda*(w_{i}-i_{i})$

Update BMU Neighbors

Update Learning Rate

end for

return $W$ END

POPSOM, outlined in Algorithm 1, is the SOM algorithm chosen for this work
[62]. It takes four inputs: the number of rows (n), the number of columns (m),
the learning rate (LR), and the total number of epochs (T). Radius is also a
common parameter that needs to be set in most SOM algorithms, however, POPSOM
calculates its initial radius using $n$, $m$, and LR. The $n$ and $m$
determine the size of the map, while $LR$ is how aggressive the model adjusts
its weights. The SOM trains for a total of $T$ epochs before finishing. The
algorithm begins by selecting a random training sample. Then, the Best
Matching Unit (BMU) is calculated by finding the smallest euclidean distance
from the training sample to a SOM node. After the BMU is found, it and its
neighbors are updated using the formula $w_{i}=w_{i}-\lambda*(w_{i}-i_{i})$,
where $w$ is the set of BMU weights and $i$ is the set of feature values.
$\lambda$ is the learning rate function that considers the current training
iteration, the chosen $LR$, and the distance from the BMU. Lastly, the
learning rate, neighborhood radius, and current iteration numbers are updated.
The function $\lambda$ works in a way that it decreases during the course of
the training process.

SOMs have some unique advantages that come with their application. The first
is algorithmic simplicity. As shown in Algorithm 1, the brevity of the
algorithm helps to maintain the desired properties of algorithmic
decomposability and tractability. Additionally, due to its unsupervised
nature, SOMs can work on a variety of datasets and applications (e.g. data
mining and discovery), not just prediction [63]. By design, SOMs convert high-
dimensional data into a lower dimensional representation. This representation
can be topologically clustered and explained through visualizations [44]. One
challenge that comes with the application of SOMs is the selection of the size
parameters, as the size does not dynamically adjust and there is no best size
heuristic [64]. Finally, another challenge with SOMs is their scalability,
both in their time complexity, $O(N^{2})$, and space complexity. More methods,
such as those in [65], are needed to address these challenges.

###  3.4 Growing Self-Organizing Maps

SOMs were further improved by dynamically growing the 2D represented space.
The Growing Self-Orginaizing Maps (GSOM) was created by Bernd Fritzke in his
impactful work [11]. Their work kept the square architecture common to SOMs,
but allowed it to grow by adding columns or rows dynamically. Future
implementations would implement systems that allowed the SOM to grow node-by-
node rather than with full rows or columns [66]. The training process of the
GSOM is very similar to that of the SOM other than the growing process.

Algorithm 2 DBGSOM Algorithm

0: Data Dimension (D), Spread Factor (SF), Learning Rate (LR), Total Epochs
(T)

0: Weights (W) BEGIN Initialization

1: Initialize 4 starter nodes with random Weights W [0,1]

2: Calculate Growth Threshold (GT): $GT=-D*ln(SF)$ Growing Phase

3: for Each Training Epoch in T do

4: Reset Cumulative Error (CE) for all nodes to 0

5: Present training samples

6: Determine BMU using Euclidean Distance

7: Update BMU and Neighboring weights

8: Calculate CE for all BMUs

9: for all non-boundary nodes do

10: Distribute CE to neighbors

11: end for

12: for all boundary nodes CE $>$ GT do

13: Grow depending on number of available neighbor positions

14: end for

15: end for

16: return $W$ END

The GSOM algorithm chosen for this paper is the Direct Batch Growing Self-
Organizing Map (DBGSOM) [67]. Its psuedocode can be found in Alg. 2. It takes
three inputs: the dataset’s dimensions (D), Spread Factor (SF), and Learning
Rate (LR). $D$ is the number of features a dataset has. SF determines how
quickly new nodes are generated. $LR$ is the same as in the SOM. Another
important variable that is not selected by the user is the Cumulative Error
(CE). Each node in the GSOM has a $CE$ value. $CE$ is the sum of all the
differences between a sample and its BMU. This value slowly accumulates over
the course of training.

DBGSOM follows similar tenets as the original GSOM algorithm. The main
difference is that it generates new neighboring nodes in a batch process. It
is initialized with four starter nodes with randomized weights between 0 and
1. A growth threshold is calculated based on SF which is static throughout the
training process. After the DBGSOM is initialized, it enters the Growing
Phase. All nodes have their CE reset to 0. Training the GSOM is now similar to
training a SOM. Each training sample is presented to the map, and its
respective BMU is found. The BMU has its weights and CE updated based on the
training sample. Additionally, all neighbors of the BMU have their weights
updated. After all of the training data has been used to update weights, we
find all non-boundary nodes. For each of these nodes, we distribute their CE
to their neighbors. Lastly, all boundary nodes for which $CE_{i}>GT$ have a
new neighbor node generated next to it.

A major advantage of using this algorithm is the undefined size of the map.
SOMs are limited in the fact that they use an unchanging number of nodes. If a
map is too small, then different labels from the dataset can begin to merge or
take over one another. On the other hand, a larger map may lead to many
useless nodes taking up processing time. GSOMs solve this issue by adding new
nodes as needed. When the dataset processes a new idea (or a new attack in the
case of an IDS dataset), a new set of nodes can be generated with similar
weights.

###  3.5 Growing Hierarchical Self-Organizing Maps

The SOM field would enter another Renaissance in the form of the Growing
Hierarchical Self-Organizing Map (GHSOM). The authors, Dittenbach et al.,
changed the growing algorithm to not only grow horizontally but also
vertically (i.e. hierarchically) [12]. Each layer of the GHSOM consists of
independent GSOMs. For every node in a GSOM, a child GSOM can be generated.
The original GHSOM algorithm uses a Growing Grid similar to the authors above
[11]. This paper has chosen to use another implantation known as Directed
Batch Growing Hierarchical Self-Organizing Map (DBGHSOM) [67]. A major problem
with GSOMs is that the map could grow to be incredibly large, thus causing
performance issues and clustering errors. Using vertical, hierarchical growth,
the GHSOM can avoid this problem by creating many smaller GSOMs.

Algorithm 3 DBGHSOM Algorithm

0: Data Dimension (D), Spread Factor (SF), Learning Rate (LR), Total Epochs
(T)

0: Weights (W) BEGIN Initialization

1: Same as Alg. 2 Horizontal Growing Phase

2: Same as Alg 2 Vertical Growing Phase

3: Calculate the Sum of all CE (SE)

4: Calculate the Vertical Threshold VT = LR $*$ SE

5: for All nodes with CE $>$ VT do

6: Create new child DBGSOM

7: Train new child DBGSOM using Alg. 2

8: end for

9: return $W$ END

The pseudocode for the hierarchical GSOM used in this paper can be found in
Alg. 3. DBGHSOM has 3 phases: initialization, horizontal growing, and vertical
growing. The parameters, initialization, and horizontal growing phases are the
same as DBGSOM. A 2-by-2 set of nodes is created and initialized. After the
first horizontal growing phase, a vertical growth threshold (VT) is
calculated. The vertical growth threshold is a percentage of the total
cumulative error of a map. For any node $GT_{i}>VT$, we create a new DBGSOM.
This child GSOM is trained just like its parent.

GHSOMs share some of the benefits that its predecessor has, like being able to
dynamically grow. Additionally, they have the benefit of both graphically and
abstractly represent data in a hierarchical structure. This form of growth
allows for the GHSOM to learn of new attacks as the training data introduces
them. The various roots in a GHSOM can be created to have different
representations of what constitutes an attack. However, a notable issue with
GHSOMs is their ability to grow into thousands of sub-trees and roots, causing
performance issues. This problem can be addressed through a pruning process
discussed in the next section.

###  3.6 Model Optimization and Pruning

(a) U-Matrices

(b) Feature Component Maps

(c) Label Maps

(d) Pruned U-Matrices

(e) Pruned Feature Component Maps

(f) Pruned Label Maps

Figure 2: Visualizations created from GHSOM trained on NSL-KDD. The left hand
unslanted visualizations represent the root GSOM. The slanted visualizations
represent GSOMs deeper in the hierarchy of GHSOM. Figure (a) shows the Unified
Distance Matrices (U-matrices), which shows the distance between nodes with
darker areas representing nodes closer together and lighter nodes representing
further distances. Figure (b) shows the feature component maps representing
the values of specific features on each node in the GSOM. Figure (c) is the
Label maps which show the class labels of the node. Figures (d), (e), and (f)
represent the pruned versions of the GHSOMs with significantly less network
sizes. Figure 3: This figure contains the results from the trained GHSOM on
the CIC-IDS-2017 dataset. Since a GHSOM consists of many GSOMs, The tree map
diagram displays GSOMs and their nodes. In this tree map, the left half of the
map is the root GSOM. Within the root GSOM we can see a mixture of blue, red
and yellow nodes. Blue nodes indicate a benign label, red nodes indicate a
malicious label and yellow indicate a branch. The size of each node indicates
the number of times it was chosen as the BMU. Figure 4: The tree map generated
after pruning the GHSOM from Figure 3. In the previous tree map, nodes would
eventually become too small to see. The pruning process outlined in Section
3.6 allows the user to see the majority of the nodes.

One problem with GHSOMs is that it is hard to know when to stop the training
process because a branch in a future subtree could provide critical
information to the model. So models that grow very large and complex provide
good detection rates but at the same time become harder to visualize and
explain. A similar issue is found in the decision tree algorithm. Decision
trees consist of nodes and branches. Each node contains a feature threshold
learned from the training data. The threshold splits the decision making
process down separate pathways. When the observed data point reaches a
terminal node, a prediction is made using the category of that node [68].
Researchers sought to develop methods that simplify the decision tree while
retaining classification accuracy [69]. A similar method can be used to prune
a trained GHSOM.

A pessimistic pruning method based on [70, 71] can be used on a fully trained
GHSOM. From one bottom-up pass through the tree, a decision is made at every
node to keep a GSOM or delete it and its children. The pruning decision (see
Equation 1) is based on a comparison of the error rate for the best leaf of a
subtree, $e_{bl}$, and the training error rate of the subtree, $e_{st}$, plus
a tree complexity penalty, $\alpha$. This method was chosen over other methods
as it is computationally efficient, requiring one pass through the tree rather
than creating a set of possible subtrees originating from the original tree.
All error rates are based on the local input data points mapped to the
subtree:

$X(e_{st},\alpha,e_{bl})=\begin{cases}e_{st}+\alpha\geq e_{bl}&\text{Remove
Branch}\\\ \text{else}&\text{Keep Branch}\\\ \end{cases}$ (1)

$\alpha=\sqrt{\frac{(l+s)\log(n)+\log(\frac{m}{\delta})}{m_{v}}}$ (2)

The complexity penalty at any node in the tree can be calculated using
Algorithm 2. $l$ is the depth of that node, $s$ is the number of nodes in the
subtree, $n$ is the total number of nodes in the tree, $m$ is the total size
of the training data, $\delta$ is a confidence parameter between 0 and 1, and
$m_{l}$ is the local size of the data mapped to the subtree. Figure 2
demonstrates how many possible GSOMs an unclassified prediction may need to
search to be labeled, and how the pruning algorithm can help to limit this
search. This is beneficial for both performance and explanation generation.

##  4 A Competitive Learning based Explainable Intrusion Detection Systems
(X-IDS)

Explanations generated by the X-IDS should assist Cyber Security Operation
Center (CSoC) operators in their mission to protect their organization. To
help achieve this goal, we create the proof of concept Competitive Learning
(CL) based X-IDS architecture in Figure 1. The proposed architecture is based
on DARPA’s recommended architecture for XAI systems [6]. Components of the
framework can be changed to suit user’s needs. The architecture is abstract
enough, such that methods other than CL algorithms can be interchanged to
create different X-IDS. The architecture consists of four phases: pre-
modeling, modeling, post-modeling optimization, and prediction explanation. In
the pre-modeling phase, raw datasets are preprocessed and parameters are
selected for the model. In the modeling phase, our CL algorithms are trained
and quality metrics are recorded. In our proof of concept system, we are using
the SOM family of CL algorithms. In the post-modeling optimization phase,
models can then be optimized through various means described below. In the
prediction explanation phase, data mining techniques are employed on the
resulting models to generate explanatory visualizations that allow users to
understand how predictions are generated.

###  4.1 Pre-Modeling Phase

The pre-modeling phase consists of preprocessing raw datasets and initial
parameter selection. The preprocessing for our models includes feature
selection and normalization. The feature selection algorithm that we have
chosen to use is the ‘Bayesian probability of significance’ [72], which
selects the most relevant features from each dataset. The only other
preprocessing that is performed on these datasets is normalization. Feature
selection is not used when training the GHSOM. The GHSOM is able to use all of
the features in a datset more effectively due to its hierarchical nature.
After preprocessing is finished, the new, high-quality dataset can then be
passed to the model. The next section details information about the our
selected datasets and their usefulness in testing IDS.

####  4.1.1 Datasets

In this work, NSL-KDD [73] and CIC-IDS-2017 [74] are used to test the
explainability and effectiveness of our architecture. NSL-KDD is chosen
because of its wide use in the literature. There are a few major benefits to
using the NSL-KDD dataset. First, it allows our method to be compared to other
existing methods for IDS. Second, the dataset’s relatively small size allows
for quick testing and runtime comparisons against larger datasets. On the
other hand, CIC-IDS-2017 includes more modern attacks and is useful for
testing an unbalanced dataset. It was synthetically created over the course of
five days to mimic the behavior of 25 users. The use of this dataset, allows
us to show that our IDs is compatible with real-world data and to stress-test
our systems for various performative metrics. Next, we describe the important
characteristics of these two datasets.

Feature |  Description
---|---
Duration |  Length of connection
src_bytes (Source Bytes) |  Number of bytes from source to destination
dst_bytes (Destination Bytes) |  Number of bytes from destination to source
Count |  Number of connections to the same host as the current connection at a given interval
srv_count (Service Count) |  Number of connections to the same service as the current connection at a given interval
dst_host_count (Destination Host Count) |  Number of connections to the same destination
dst_host_srv_count (Destination Host Service Count) |  Number of connections to the same destination that use the same service
Table 1: Selected features from the NSL-KDD dataset. These features are used to train the SOM and the GSOM models. Feature |  Description
---|---
Flow Bytes/s |  Number of flow bytes per second
Flow Duration |  Duration of the flow in microsecond
Flow IAT Max (Flow Inter-Arrival Time Max) |  Maximum time between two packets sent in the flow
Fwd IAT Total (Forward Inter-Arrival Time Total) |  Total time between two packets sent in the forward direction
Flow Packets/s |  Number of flow packets per second
Destination Port |  Port the package was destined for
Bwd IAT Total (Backward Inter-Arrival Time Total) |  Total time between two packets sent in the backward direction
Fwd Packets/s (Forward Packets/s) |  Number of forward packets per second
Flow IAT Min (Flow Inter-Arrival Time Min) |  Minimum time between two packets sent in the flow
Packet Length Variance |  Variance length of a packet
Flow IAT Mean (Flow Inter-Arrival Time Mean) |  Mean time between two packets sent in the flow
Fwd IAT Max (Forward Inter-Arrival Time Max) |  Maximum time between two packets sent in the forward direction
Idle Max |  Maximum time a flow was idle before becoming active
Idle Mean |  Mean time a flow was idle before becoming active
Idle Min |  Minimum time a flow was idle before becoming active
Flow IAT Std Flow (Inter-Arrival Time Standard Deviation) |  Standard deviation time between two packets sent in the flow
Bwd IAT Max (Backward Inter- Arrival Time Max) |  Maximum time between two packets sent in the backward direction
Table 2: Selected features from the CIC-IDS-2017 dataset. The features are
used to train the SOM and GSOM models.

NSL-KDD dataset: The dataset contains four different kinds of attacks: Denial
of Service (DoS), User to Root (U2R), Remote to Local (R2L), and Probing. The
DoS is an attack that affects the availability of a service, usually causing
that service to be unreachable due to too many connection attempts. However,
in general a U2R attack affects the confidentiality or integrity of data.
Malicious users, by some means, may gain root access to a system and may be
able to view or modify data as they please. Similarly, a R2L attack is one
where attackers may gain remote access to a machine for which they should not
have access. Lastly, probing is a method of information gathering achieved by
attackers. This attack looks for known compromised modules that are connected
to the internet. While the features (see Table 1) of NSL-KDD mainly pertain to
tcp/ip packet information, there are also features relating to traffic and
content. Traffic features contain information about the duration and amount of
connections. Content features contain information about data that the
attackers sent in the packet.

CIC-IDS-2017: The dataset includes six types of attacks: Brute Force,
Heartbleed, Botnet, Denial of Service, Distributed Denial of Service (DDoS),
Web, and Infiltration. A Brute Force attack is a common type of attack whereby
a malicious actor tries millions of passwords in an attempt to gain access to
a user or administrator account. This type of attack will use resources such
as the ‘rockyou.txt’ common passwords list and can affect all aspects of the
CIA triad. Heartbleed is a confidentiality attack that exploits a weakness in
the OpenSSL library [75]. Abusing this bug allows attackers access to
encrypted data by reading straight from a compromised system’s memory. A
Botnet attack refers to the involvement of a set of machines used by an
attacker to perform a malicious task. It can affect confidentiality,
availability, and integrity. The DDoS attacks differ slightly from the DoS
attacks in that this type of attack originates from many different hosts. The
Web attacks consist of various SQL injections and Cross-Site Scripting attacks
that can affect confidentiality and integrity of data. Lastly, Infiltration
attacks exploit vulnerable software on a user’s system to allow an attacker to
gain backdoor access potentially affecting all CIA tenets. The dataset
consists of 80 features generated from network traffic using CICFLowMeter
[76]. A quick reference for the selected CIC-IDS-2017 features can be seen in
Table 2.

####  4.1.2 Model Parameters

The SOM parameters consist of: $n$ x $m$ rows and columns, the number of
training epochs, and a learning rate (LR). Picking the size of $n$ and $m$ is
one of the most important decisions. If the values are too small, clusters
will not separate and can begin to merge. If the values are too large, proper
clusters may not form at all and resources can be wasted. Determining what
this parameter should be is done through trial and error. Similarly, the
number of training epochs can cause significant performance increases. Both
scenarios, the one with too many epochs and the one with too few epochs, can
cause overfitting and underfitting, or simply waste time. Lastly, LR values
affect the learning rate function. A higher value will cause larger changes
when adjusting Best Matching Units (BMUs) towards training samples. If the
learning rate is set too high, BMU values will mimic singular instances of
data. This leads to a less abstract understanding of the data that can cause
decreases in accuracy. Too low a value will cause the model to not learn at
all. In our testing, we found that a moderately low LR worked best for our
datasets.

GSOM and GHSOM contain different parameters than the SOM. These algorithms no
longer need to have the number of rows and columns defined. They always start
with a 2 x 2 set of nodes. A new, important parameter is the Spread Factor
(SF). The SF determines how much Cumulative Error (CE) (see Section 3) is
needed to create a new, horizontal or vertical node. Smaller SF values cause
more node generation. LR is used for the same purpose as in the SOM. It
determines how much a BMU will change with regard to the training samples.
However, the GHSOM uses LR to also dictate the vertical growth threshold. The
pruned GHSOM includes an additional parameter $\delta$ which determines how
aggressively the model is pruned. Table 3 contains all of our experimental
settings.

Data preprocessing and parameter selection are difficult processes that
require many iterations to attain the best results. In our work, we have
determined that minimal preprocessing is needed to attain high performative
results. Initial parameter selection can be done by hand, while later, the
user relies on search algorithms depending on the architecture. Both GSOM and
GHSOM have been optimized using a process outlined in Section 4.3. The next
phase will take the newly preprocessed dataset and selected parameters to
create well trained models.

| Parameter | NSL-KDD | CIC-IDS-2017
---|---|---|---
SOM | n | 18 | 18
m | 18 | 18
LR | .3 | .3
Epochs | 1000 | 1000
GSOM | LR | .006 | .006
SF | .9 | .9
Epochs | 100 | 40
GHSOM | LR | .006 | .006
SF | .3 | .3
Epochs | 100 | 40
$\delta$ | .3 | .3
Table 3: The selected parameters for each CL model. $n$ and $m$ determine the
amount of rows and columns the SOM will have. LR is the learning rate that
will affect node weight adjustments. SF is the spread factor that affects how
often new nodes form in GSOM and GHSOM. Epochs are the total number of
training iterations a CL model will go through. $\delta$ is the confidence
interval used to prune the GHSOM.

###  4.2 Modeling Phase

Using the high quality dataset and the parameters selected in the pre-modeling
phase, we can train the set of CL models. We utilize a subclass of CL models
described in Section 3 which includes three variants of the self organizing
map algorithm: the Self Organizing Map (SOM), the Growing Self Organizing Map
(GSOM), and the Growing Hierarchical Self Organizing Map (GHSOM). These
algorithms create clusters mimicking input data, and in doing so, they create
a map that can be data-mined for explanatory purposes. The SOM is the most
basic of the three algorithms. It consists of a grid of nodes with no logic to
grow and change shape. While, this allows the algorithm to be more easily
understood, it can lead to poorer performative results. The GSOM and GHSOM
algorithms address this issue by allowing the map of nodes to grow
horizontally and vertically. These algorithms are able to understand more
complex structures in data, and their growing nature helps to accommodate
these new structures. Please see Section 3 for a more in depth description of
these algorithms.

####  4.2.1 Model Evaluation Metrics & Techniques

There have been various metrics and measures proposed to evaluate the quality
of a trained SOM. These include quantization error, topographic error,
embedding accuracy, and convergence index. The quantization error was used by
Kohenen [77], and measures the average distance between nodes and the data
points. The topographic error measures how well preserved features are in the
low dimensional output space. It is measured by evaluating how often the BMU
and the second BMU are next to each other [64, 78]. The map embedding accuracy
is similar to the quantization error. This metric measures how similar the
distribution of the input data is with respect to that of the SOM units [79].
In order to measure both topographic preservation and distribution similarity
between the input and SOM units, the convergence index was proposed to be a
measure that linearly combines the map embedding accuracy and the topographic
error [80]. Performative metrics are also important to include in an IDS
architecture. These metrics include accuracy, F1-score, false positive rate,
and false negative rate. We also opt to include training time and prediction
speed since they can play an important role in intrusion detection. The
experimental results using these performative metrics can be view in Section
5. These measurements allow the architecture to be compared to the
architecture of other existing IDS.

###  4.3 Post-Modeling Optimization Phase

Selecting the best parameters for a ML model is an important challenge.
However, doing such work by hand is a time consuming process. This is
especially true when training times begin to scale higher. Luckily, there are
methods that can automate this process. Additionally, some models may also
benefit from post-processing. Many tree based models will use a form of post-
processing known as pruning to reduce the chance of overfitting and speed up
decisions. In this work, we have chosen two techniques for post-modeling
optimization. A Bayesian search process is employed to find the parameters for
improved performative results, and a pruning technique is used to optimize the
size of the GHSOM.

####  4.3.1 Parameter Optimization

There are a few notable methods that can be used for parameter optimization.
For this work, we considered Grid search, Random search, and Bayesian search.
The differences in these search algorithms relate to how each selects its next
set of test parameters. Grid search acts like a brute force approach. It tests
as many combinations of parameters as possible. This process is time
consuming, but one is more likely to find the best parameters for their model.
Random search differs from this approach by sampling a specified number of
time from a range of values. This approach limits the number of options that
are tested but does not check the entire space of parameter combinations. The
last option and the one chosen for our architecture is the Bayesian search.
This method limits the search space by creating a surrogate probability model.
It makes informed decisions about each set of parameters tested. On average,
Bayesian search is able to find a better set of parameters faster than the
other two algorithms. The trade-off is that it may not find the best set of
parameters as it doesn’t search the entire parameter space.

####  4.3.2 GHSOM Model Pruning

Model pruning can be a valuable resource for certain algorithms. GHSOMs can
benefit from pruning by reducing the number of nodes needed to match against.
Another notable reason to prune a GHSOM is for easier visualization. GHSOMs
can grow into hundreds or thousands of branches making visualization a
daunting task. The goal of pruning a tree is to limit its size while also
retaining as much information as possible. As mentioned in Section 3, we use a
pessimistic pruning approach. It is a bottom-up approach that determines
whether each node should be kept. To prune a node, an error rate comparison is
made. When the error rate for a node is high in comparison to the average
error rate, it is removed from the tree. Since this is a bottom-up approach, a
node and all of its children can be removed. The visualization changes can be
seen in Figures 3 and 4.

Optimized models are important for both detection rates and performance. The
benefits from this phase can be seen in Table 4. Using parameter optimization,
we are able to increase the accuracy of our models, while the pruning process
allows for faster predictions. These are both important factors when an system
is being used of network security.

###  4.4 Prediction Explanation Phase

Once the modeling and optimization phases have been completed, and the quality
metrics have ensured that the model is a good representation of the data, the
model can be used to perform a variety of explainability and visualizations.
The models themselves are lists of SOM nodes and the weights associated with
these nodes. Visualizations include creating local and global explanations,
U-Matrices, and feature heatmaps. Users can use explanations to perform tasks
to better defend the network. When a user receives a subpar explanation, the
user can modify to the architecture where needed to help bolster the X-IDS.

####  4.4.1 Local and Global Explanations

Global and local explainability can be achieved by examining important
features of the trained SOM, and utilizing this information to generate an
explanation for a specific data instance classification or cluster
classification [81]. Global significance for NSL-KDD is shown in Figure 5(b)
with higher values denoting that a feature has a higher probability of being
important. The algorithm chosen to determine this variance was ‘Bayesian
probability of significance’ [72]. Higher variance features increase the
probability that a model will capture the dataset’s structure. Through this
graph, an analyst can understand which features are important to the overall
SOM structure, allowing them to examine predictions at a local level based on
globally important features.

Figure 5(a) shows the GSOM local explanations for a prediction on the NSL-KDD
dataset. Each feature has a value representing the significance. Significance
(S) is a calculation involving the min-maxed distances from a BMU (See Section
3) inverted so that higher values are more important. The formula can be seen
in Formula 3. In this example, we can see the features with the largest impact
on a prediction: destination (dst) host count, duration, and destination (dst)
bytes (see Table 1). These features were the closest to the BMU, therefore,
they played a large role in computing the predicted value. Seeing the specific
features that influence predictions provides insight into samples labeled as
malicious or benign and can further help users determine the reason for
incorrect predictions. These features can also be further investigated with
feature value heat maps.

$S=1-(\frac{X-X_{min}}{X_{max}-X_{min}})$ (3)

####  4.4.2 Unified Distance Matrix (U-Matrix)

The U-Matrix visualizes the distances between neighboring SOM nodes. With
distances shown as a color gradient, nodes far apart will create light
boundaries while areas with similar nodes will be darker. This can visually
represent the natural clusters of input data. To enhance the standard
U-Matrix, the starburst model uses connected component lines of nodes overlaid
on the matrix to better represent clusters [82]. For a labeled data set, the
user is able to visualize each BMU along with the associated label. Figure
6(a) shows clear clusters with boundaries separating malicious (1) and benign
(0) behavior. Using this information a users can investigate more
visualizations and feature importance values to gain an understanding of why
certain malicious network activities are being grouped together.

####  4.4.3 Feature Value Heat Map

A heat map applied to a feature shows general trends that a feature has on a
model, in this case the entire SOM model. SOM feature values are represented
from 0 to 1, and the heat maps denote this with darker and lighter values,
respectively. An example feature value heat map can be found in Figure 6(b).
In this example, the ‘dst bytes’ feature has a cluster of higher values in the
top-right corner, while the rest of the SOM consists of lower values. Users
can use this information to form conclusions about the model. Feature value
maps are more powerful when multiple are viewed at a time. The U-Matrix chart
can then be referenced to make general decisions about the model. The heat
maps work well as a fine-grained global explanation that helps users to
understand the overall model.

####  4.4.4 Users Performing Tasks

An important component of our architecture is its user-in-the-loop system. A
‘user’ is a network’s stakeholder. There can be many kinds of stakeholders for
an IDS. AI engineers who implement and maintain the X-IDS architecture,
security analysts who protect the network, and investors manage security
expenses. Tasks are performed with the goal of protecting the network and are
enhanced by the X-IDS’s generated predictions.

When a satisfactory prediction has been created, a user can perform their
task. Satisfactory explanations will cause the user to be able to perform
their tasks more effectively. However, not all explanations will be useful.
When an unsatisfactory explanation is created, a user can use that explanation
to make changes to the parts of the architecture. This could be accomplished
by changing how datasets are preprocessed, choosing a new ML model, modifying
optimizations, or creating a new style of explanation.

Prediction explanation plays a pivotal role in an X-IDS architecture.
Visualizations and statistics are critical for creating actionable
explanations for a network. Local explanations can help programmers and
security analysts to fine-tune the model, while global explanations can be
used by investors to understand the model at a high level. Users can use
predictions to either defend the network, or fortify the intrusion detection
system. In the next section, we demonstrate the performative results of our
models using the above described architecture.

##  5 Evaluation & Experimental Results

0pt

(a) NSL-KDD Local Anomaly Explanation

0pt

(b) NSL-KDD Global Feature Significance

0pt

(c) CIC-IDS-2017 Local Anomalous Explanation

0pt

(d) CIC-IDS-2017 Global Feature Significance

Figure 5: These figures show the local and global feature explanations for
both the NSL-KDD and CIC-IDS datasets. (a)(c) Demonstrates features the GSOM
has chosen for a malicous sample from the NSL-KDD and CIC-IDS-2017 datasets.
The more siginficant a feature is, the higher its value. (b)(d) Global feature
significance is calculated using Bayesian Probability of Significance [72].
Features that have a higher significance value are much more likely to cause a
prediction to be made for benign or anomalous. The global explanations apply
to all of the tested models

Our CL based architecture and its SOM variants were evaluated on both
traditional performative tests and explanation generation. The datasets used
to test our architecture were NSL-KDD and CIC-IDS-2017 (see Section 4.1). In
this section, we examine the performative results from all our CL models, and
the explanation results from the Growing Self Organizing Map (GSOM) model. The
GSOM explanations were chosen because of the high accuracy of the GSOM model
and its similarity to both the SOM and GHSOM.

###  5.1 Performative Tests

NSL-KDD
---
| SOM | GSOM | GHSOM | P-GHSOM |  | NDNN
---
Jia et al. [83]
| CNN
---
Mohammadpour
et al. [84]
| BGRU+MLP
---
Xu et al. [85]
| BAT-MC
---
Su et al. [86]
Accuracy | 90.9% | 96.7% | 98.2% | 98.0% | 95.0% | 99.8% | 99.3% | 99.2%
Precision | 97.2% | 96.6% | 98.0% | 98.0% | - | - | - | -
Recall | 83.3% | 96.5% | 98.3% | 97.8% | 97.4% | - | 99.3% | -
F1 | 89.7% | 96.6% | 98.1% | 97.9% | 91.4% | - | - | -
FPR | 2.2% | 3.1% | 1.9% | 1.8% | - | - | 0.8% | -
FNR | 16.6% | 3.5% | 1.6 | 2.2% | - | - | - | -
Network Size | 1 | 1 | 7288 | 574 | - | - | - | -
Training Time (s) | 8 | 60 | 692 | 816 | - | - | - | -
Prediction Time (ms) | .03 | .03 | .06 | .04 | - | - | - | -
CIC-IDS-2017
| SOM | GSOM | GHSOM | P-GHSOM |  | SDCNN
---
Khan et al. [87]
| DNN+RE
---
Almutlaq
et al. [88]
| SS-Deep-ID
---
Abdel-Basset
et al. [89]
| CNN-IDS*
---
Halbouni
et al. [90]
Accuracy | 79.4% | 94.6% | 96.7% | 95.7% | 99.3% | 97.4% | 99.6% | 99.6%
Precision | 83.2% | 83.7% | 89.1% | 86.5% | 99.1% | 98.3% | 99.5% | 99.7%
Recall | 42.0% | 90.0% | 94.5% | 92.7% | 99.7% | 99.2% | 99.2% | 99.4%
F1 | 55.8% | 86.7% | 91.7% | 89.5% | 99.4% | 98.3% | 99.4% | 99.7%
FPR | 19.0% | 4.3% | 2.8% | 3.5% | 1.0% | - | 0.7% | 0.5%
FNR | 23.0% | 10.0% | 5.5% | 7.3% | 1.0% | - | 0.5% | -
Network Size | 1 | 1 | 16894 | 119 | - | - | - | -
Training Time (s) | 260 | 1820 | 4299 | 11205 | - | - | - | -
Prediction Time (ms) | .03 | .06 | 1.5 | .03 | - | - | - | -

Table 4: This table shows the results from testing our CL based X-IDS
architecture. We compare our results with existing black box EBL models
including deep neural networks, convoluted neural networks, and various
ensemble methods.

The experimental results consist of accuracy, precision, recall, f1, false
positive rate, false negative rate, and network size measures. Accuracy refers
to the percentage of correct predictions compared to the total test size.
Precision measures the ratio of true positive predictions to the total number
of positive predictions. Recall is the measure of true positive predictions to
the total number of positive samples in the test set. The f1 score is a
measure that gives equal weight of precision and recall. False positive rate
is the rate of false positive predictions compared to the amount of ground
truth negatives. False negative rate is the rate of false negative predictions
compared to the amount of ground truth positives. Network size is simply the
amount of GSOMs within the hierarchical GHSOM structure. For SOMs and GSOMs,
the network size is 1. The training time of each algorithm and the average
time for a single prediction is also measured. All results can be found in
Table 4.

####  5.1.1 Testing Parameters

The parameters selected for our models can be found in Table 3. In this work,
the SOM was setup to run over 1000 epochs using an 18 $x$ 18 map. We found
that increasing the number of epochs served to overfit the models and decrease
the overall efficacy of the model. Both the size of the map and the number of
training epochs were chosen through trial and error. The GSOM parameters were
set to 100 and 40 training epochs for NSL-KDD and CIC-IDS-2017 respectively.
We found that this in addition to an aggressive Spread Factor (SF) of .9
created the best performative results. The GHSOM parameters were set to 100
epochs per GSOM created using a SF of .3 and a Learning Rate (LR) of .006.
These settings were discovered using the parameter selection process outlined
in Section 4.4. Using these parameters, we were able to create well trained,
highly accurate models.

(a) NSL-KDD Starburst U-Matrix

(b) Dst byte Feature Map

0pt

(c) CIC-IDS-2017 Starburst U-Matrix

0pt

(d) Flow bytes/s Feature Map

Figure 6: (a)(d)The Starburst U-Matrix shows both the most common label for
each node and the clusters the SOM has learned. Darker areas represent units
that are close Euclidean Distance-wise. Notably, we can see a clear divide
between classes on the NSL-KDD dataset as represented in the figure. (b)(e)
K-means clustering can be used as a simplified view of where labels appear on
the SOM. In this model’s iteration, anomalous traffic is mostly grouped on the
bottom of the SOM.(c) The feature value heatmap displays the value of a
specific feature on each unit in the SOM. Lighter values represent units with
values closer to 1, while darker values show values closer to 0. The ‘dst
byte’ example shows that the bottom ‘anomalous’ cluster values higher values.

####  5.1.2 Performative Results

The first part of our experiments looked at how accurate our architecture
could be. The SOM performed the worst out of our set of CL algorithms. This is
expected as it is the least complex of the three algorithms. It achieved an
accuracy of 90.9% on NSL-KDD and 79.4% on CIC-IDS-2017. The majority of its
accuracy loss comes from its high false negative rate for NSL-KDD and both
error rates for CIC-IDS-2017. Out of all of the models, the SOM is the fastest
to train and predict with. This may not be a good trade-off, however, with how
low its accuracy is. On the other hand, the GSOM, using a more complex
algorithm, is able to achieve a much higher accuracy of 96.7%. The GSOM’s
growing nature allows it to adapt to new benign and malicious behavior,
reducing the number of false negatives. The gain in accuracy comes with the
cost of additional training time. Finally, we tested the GHSOM with and
without feature selection. The feature selected GHSOM produces an accuracy of
96.2% and 96.1% for the normal and pruned variants on the NSL-KDD dataset. The
CIC-IDS-2017 feature selected models both achieved accuracies of 96.0%. When
run without feature selection, the model increases its accuracy to 98.2% and
98.0% for normal and pruned NSL-KDD variants and 96.7% and 95.7% for CIC-
IDS-2017. The GHSOM is able to perform better when it has more features.
Because of its ability to grow both vertically and horizontally, it is able to
make connections in data that its predecessors can not. We also tested the
GSOM model using all features. Unlike the GHSOM, it does not benefit from
having more information. Overall, the GHSOM with no feature selection performs
the best out of all of our CL models.

The models from our architecture can also be compared to other algorithms in
the literature. Some of the best performing algorithms are variations of Deep
Neural Networks (DNN) and other black box Neural Networks (NN). These black
box models are able to capture complexities in data that no human or white box
model could comprehend. However, a major problem these black box models have
is that they are not easily explainable. Unlike the CL algorithms detailed
above, information is given to these NNs and no explanation is given as to why
a prediction is made. Table 4 compares our results to some works in the
literature. Note that these models either have no feature selection or a
different feature selection than our own models, and the authors did not list
all possible metrics. The NSL-KDD and CIC-IDS-2017 dataset models are all
similar in accuracy. Our GHSOM architecture has between 1% - 3% lower accuracy
compared to others, however, the GHSOM is by far more explainable. Even with
the small loss in accuracy, we believe that an explainable IDS can be more
beneficial for users. Using the explanations given to us by our models, it may
be possible to modify parts of the architecture to match the black box models’
accuracy.

###  5.2 Explanation Generation

Explanation generation can be divided into two subcategories: Statistical and
Visual. Statistical explanations for our architecture consist of Global and
local feature significance charts. These explanations can help build a general
understanding of the model but lack topographical information. Visual
explanations are datamined from the CL models and allow the user to combine
the statistical explanations with topographical information. These include the
U-matrix, feature heatmap, and label map. In this section, we will discuss the
GSOM’s explanations. The GSOM performed just as well as the GHSOM with regard
to accuracy and uses the same explanations as the GHSOM. However, the GHSOM
may require the user to look at its many different hierarchical GSOMs to be
useful. Therefore, any method used to understand the GSOM model can also be
expanded to the GHSOM.

####  5.2.1 Global Explanations

Global significance explanations allow the user to form a general
understanding of models and datasets. ‘Bayesian probability of significance’
is the method we chose to create global explanations [72]. This algorithm
calculates feature variance where, in theory, features with higher variance
are more likely to cause clustering in data. Using explanations created with
this method, users can begin to create a strategy for examining explanations.
This can help a user when faced with a dataset with many features. However, a
global explanation is not guaranteed to be useful for all predictions. This
type of global explanation is probabilistic in nature. Some local predictions
may use the least probable features when choosing a label. Global feature
significance explanations should be used as a guide to help examine the
datasets and explanatory outputs.

The global explanations for our two datasets can be found in Figures 5(b) and
5(d). More important features are denoted with higher significance. For the
NSL-KDD dataset, we can see the top three most significant features are
‘Destination (dst) bytes’, ‘dst host count’, and ‘Source (src) bytes’.
Additionally, we can see that even though these three are the most important,
the other features have high enough significance that they could play a role
in predictions. The CIC-IDS-2017 global explanation tells a different story.
‘Flow bytes/s’ has the highest variance among all of the features. We can
classify this as the most significant feature while viewing the next 11
features (‘flow duration’ to ‘Forward (fwd) packets/s’) as being somewhat
significant. The final five features are less likely to impact the model.

Using the global explanations in Figures 5(b) and 5(d), we can form some
initial conclusions about the models and datasets. For NSL-KDD, benign and
malicious packets differ in size, length, and number. This is demonstrated by
‘dst host count’, ‘duration’, and ‘dst bytes’. At this stage, forming any
other conclusions may not be beneficial. One of these features may be a good
starting point to look at for later explanation types. Malicious and benign
traffic in the CIC-IDS-2017 dataset appears to vary in how much data is sent
over the network. Similar to the NSL-KDD dataset, it may not be a good idea to
form a more concrete opinion about the models just yet. However, we do know
that malicious and benign data differ in the ways mentioned above, and these
ideas may be good concepts to investigate.

####  5.2.2 Local Explanation

The local prediction explanations for GSOM anomalies can be found in Figures
5(a) and 5(c). Using local explanations, users can take their coarse
understanding of the dataset and begin fine tuning it. Here, we will look at
an anomalous local explanation from each dataset, however, it may be
beneficial for a user to view many at one time. Local explanations are created
by examining a feature’s proximity to its BMU counterpart (see Section 4.4).
The most important features have higher values.

The anomalous prediction for NSL-KDD in Figure 5(a) can be used to demonstrate
how to understand local prediction explanations. For this anomaly,
‘Destination (dst) host count’, ‘duration’, and ’dst bytes’ were the most
important features. CIC-IDS-2017’s local anomalous explanation has some
interesting features. Eight features have a proximity of one or very near to
one. Five of its features are of some significance to the prediction, while
the first four are less or not significant.

To be able to better understand how the model labels predictions, multiple
local explanations should be used. Ideally, the user would need to look at
many anomalous and benign explanations. Doing so would allow the user to
solidify their idea of how the model makes a malicious or benign prediction.
Looking at our NSL-KDD anomaly explanation, it is similar to the global
explanation. ‘Destination (dst) host count’, ‘dst bytes’, and ‘src bytes’ are
all of higher importance. However, ‘duration’ has also made a large impact
even though it was considered less significant globally. If we look at other
malicious prediction explanations, we see a similar trend. The NSL-KDD model
uses these features to make many anomalous predictions. The CIC-IDS-2017
explanation states that ‘flow bytes/s’ and seven other features are what cause
this anomaly. Similar to NSL-KDD, this trend tends to hold true over many
other anomalous predictions. One or more of the features may change places of
importance, but a pattern can be seen in the explanations.

The user, now having examined both global and local explanations, has
hopefully begun to form a mental model of how the GSOM makes predictions. The
process used in this section can be used to form a general understanding of
the SOM and GHSOM models. Using clues discovered in their investigation, a
user may want to view visual explanations for specific features. The
topological information gleaned from these explanations may prove fruitful in
understanding the model even better.

####  5.2.3 Visual Explanations

(a) NSL-KDD U-Matrix

(b) Feature Component Map of Dst-Bytes

(c) NSL-KDD Neuron Labels

(d) CIC-IDS-2017 U-Matrix

(e) Feature Component Map of Flow Bytes/s

(f) CIC-IDS-2017 Neuron Labels

Figure 7: Visualizations generated from a GSOM for models trained on NSL-KDD
and CIC-IDS-2107. (a)(d) The U-matrix maintains the same properties as the SOM
starburst visualization with darker areas representing neurons closer
together. (b)(e) The Feature Component Map also shares the same properties as
the SOM feature map in Figure 5.2. (c)(f) The Neuron Label map shows the class
label represented by a red or yellow color.

Unlike the statistical explanations, the three visual explanations need to be
viewed together. Examples of these explanations can be seen in Figure 7. The
U-matrix is a hexagonal grid composed of dark and light nodes. Darker cells
represent nodes in the GSOM that are closer to one another. Lighter cells
denote a separation of nodes and clusters. The label map contains the label
used by each node for prediction. Light yellow nodes assign a prediction label
of malicious while dark red nodes assign a prediction label of benign. A shade
in between yellow and red indicate when a node has a probability of choosing
either benign or malicious. Finally, the feature heatmap contains visualized
information of a single feature in the GSOM. Since each node represents a
sample from the dataset, we are able to visually map feature values. Lighter
colored nodes contain a feature value closer to one, while the darker values
are closer to zero.

Firstly, we can look at the U-matrix to see how many clusters there are and
where they formed. The NSL-KDD model created about five clusters seen in
Figure 7(a). Four clusters appear on the edge of the map with a smaller one in
the middle. In Figure 7(d), the CIC-IDS-2017 model created between four to six
clusters. Similar to the NSL-KDD U-matrix, the user may see that there is a
cluster at the top, left, bottom, right, and middle of the map. Now that we
have defined the clusters, we can look at each cluster’s associated label. The
NSL-KDD model appears to label the bottom-left and middle clusters as
anomalous. The other clusters seem to be mostly benign. For CIC-IDS-2017, we
can see that nearly the entire map is benign. There are a few clusters of
malicious labels, but they are intermixed with benign data. Lastly, we can
look at the meaning of the feature heat map. The NSL-KDD feature heat map
represents the ‘desetination (dst) bytes’ feature. Here, we can see that the
top-left of the map contains higher values of ‘dst bytes’ while the rest of
the map contains much lower values. Similarly, the CIC-IDS-2017 dataset’s
‘flow bytes/s’ is much higher in the bottom-left than anywhere else on the
map.

With our new understanding of visual explanations, we can combine them to form
more complex ideas about the model. A user can view both the feature heat map
and the U-matrix and see that there is a cluster of nodes associated with high
‘dst bytes’ values. They can then look to the neuron label map and see that
this cluster is associated with benign data. This thought process can be used
with the other features from the dataset. The user can then decide that they
want to view the dataset’s next most significant feature. In NSL-KDD’s case,
the next best feature would be ‘dst host count’. Alternatively, the user could
decide to use a local explanation to make decisions about which features to
view. The process outlined above can be used for larger datasets such as CIC-
IDS-2017 to guide the user into forming conclusions about the model.

####  5.2.4 User Conclusions

Having looked at all of the explanations, a user may now make a few decisions.
The first is that the explanations were sufficient such that they can complete
their task. The second is that they believe that the model could perform
better or output better explanations that could benefit their task. The NSL-
KDD explanations may be sufficient for a user, however, the CIC-IDS-2017 model
has some flaws that could affect its accuracy. The user could see that the
CIC-IDS-2017 explanations heavily favor benign data. Using the architecture
diagram defined in Figure 1, the user may modify different aspects of the
architecture. In this case, the user may decide to preprocess the CIC-IDS-2017
dataset differently. It is possible that stratifying the training portion of
the dataset would create a more balanced set of clusters.

####  5.2.5 SOM and GHSOM Explanations

The process outlined above can also be used to understand both SOM and GHSOM
explanations. In fact, the global and local explanations for these two
algorithms look the same. However, the SOM algorithm that we chose uses a
visual explanation that combines the U-matrix and label map. It also includes
a starburst-like pattern that helps dictate where the centers of the clusters
are and how far they stretch. We leave the SOM explanations in Figure 6 as an
exercise for the reader to form their own conclusions using the above process.
Lastly, the GHSOM uses the same visual explanations as the GSOM, but it would
require many different images of each to explain. Instead, we have created a
visualization representing the hierarchical structure of the GHSOM that
includes how each GSOM within labels data. This visualization for the pruned
GHSOM can be seen in Figures 4. In the figure, red represents a node that
labels data as malicious, blue nodes are benign, and yellow indicates a
branching node.

##  6 Conclusion

In this paper, we created an Explainable Intrusion Detection (X-IDS)
architecture featuring three Competitive Learning (CL) based algorithms. It
was built using DARPA’s recommended guidelines for an explainable system. The
architecture consists of four phases: Pre-Modeling, Modeling, Post-Modeling
Optimization, and Prediction Explanation. In the Pre-Modeling phase, we
preprocess datasets and select our initial model parameters. In the Modeling
phase, we train the Self Organizing Map (SOM), Growing Self Organizing Map
(GSOM) and Growing Hierarchical Self Organizing Map (GHSOM) and record quality
metrics. In the Post-Modeling Optimization phase, we find better model
parameters to achieve higher accuracy results, and we implement a pruning
process for the GHSOM model. Lastly, we generate explanations and allow the
user to make modifications to the architecture in the Prediction Explanation
phase. When compared with existing Error Based Learning (EBL) algorithms, CL
algorithms are less accurate. However, CL algorithms are far more explainable,
leading to a more trustworthy IDS.

The main objective of this paper was to demonstrate the explanatory properties
of CL algorithms. In our explanation discussion, we showed that CL algorithms
are highly explainable because of their ability to mimic patterns in data.
This is a feature that EBL techniques lack. We demonstrated a strategy that a
user could use to be able to understand explanations to better trust or
improve the model. This strategy involved using course grain explanations such
as the global and local feature significance charts to form a general
understanding of the models. With this general understanding, users can then
use the feature heatmaps, U-matrices, and label maps to form a more
comprehensive knowledge of the model.

Additionally, a pruning process was applied on the GHSOM in an effort to lower
the number of branches it generated. We were able to decrease the size of the
GHSOM by 92% - 99% while only losing 0.2% - 1.0% accuracy. This lowers the
performative overhead and allows the pruned GHSOM to make predictions faster
than the unpruned GHSOM. Additionally, reducing the size of the GHSOM can help
with visualizing explanations.

Lastly, a performance analysis was performed on our CL-based X-IDS
architecture. Tests were run using the NSL-KDD and CIC-IDS-2017 datasets. Our
experimental results showed that the CL models can achieve accuracies as high
as 98.2% on the NSL-KDD dataset and 96.7% on the CIC-IDS-2017 dataset. We
compare these results with existing EBL algorithms. We find that EBL
algorithms are 1% to 3% more accurate than the CL algorithms, however, EBL
models are far less explainable.

The future for intrusion detection is explainability. Using architectures and
methods, such as the ones used in this paper, will lead to more powerful and
trustworthy IDS. White box methods can be improved and adapted to create more
accurate AI models. Competitive Learning algorithms embody this philosophy.
Their explainability, ease of use, and low performative cost allow for them to
be the front runners for future X-IDS.

## Acknowledgement

This work by Mississippi State University was financially supported by the
U.S. Department of Defense (DoD) High Performance Computing Modernization
Program, through the US Army Engineering Research and Develop Center (ERDC)
(#W912HZ-21-C0058). The views and conclusions contained herein are those of
the authors and should not be interpreted as necessarily representing the
official policies or endorsements, either expressed or implied, of the U.S.
Army ERDC or the U.S. DoD.

## References

  * [1] S. Neupane, J. Ables, W. Anderson, S. Mittal, S. Rahimi, I. Banicescu, M. Seale, Explainable intrusion detection systems (x-ids): A survey of current methods, challenges, and opportunities, arXiv preprint arXiv:2207.06236 (2022).
  * [2] S. Iannucci, J. Ables, W. Anderson, B. Abburi, V. Cardellini, I. Banicescu, A performance-oriented comparison of neural network approaches for anomaly-based intrusion detection, in: 2021 IEEE Symposium Series on Computational Intelligence (SSCI), IEEE, 2021, pp. 1–7.
  * [3] A. L. Buczak, E. Guven, A survey of data mining and machine learning methods for cyber security intrusion detection, IEEE Communications surveys & tutorials 18 (2) (2015) 1153–1176.
  * [4] A. Marshan, Artificial intelligence: Explainability, ethical issues and bias, Annals of Robotics and Automation (2021) 034–037doi:10.17352/ara.000011.
  * [5] J. Ables, T. Kirby, W. Anderson, S. Mittal, S. Rahimi, I. Banicescu, M. Seale, Creating an Explainable Intrusion Detection System Using Self Organizing Maps, in: IEEE Symposium on Computational Intelligence in Cyber Security, 2022\.
  * [6] D. Gunning, D. Aha, Darpa’s explainable artificial intelligence (xai) program, AI Magazine 40 (2) (2019) 44–58.
  * [7] M. T. Ribeiro, S. Singh, C. Guestrin, ”Why should i trust you?” explaining the predictions of any classifier, in: Proceedings of the 22nd ACM SIGKDD international conference on knowledge discovery and data mining, 2016, pp. 1135–1144.
  * [8] S. M. Lundberg, S.-I. Lee, A unified approach to interpreting model predictions, Advances in neural information processing systems 30 (2017).
  * [9] A. Binder, G. Montavon, S. Lapuschkin, K.-R. Müller, W. Samek, Layer-wise relevance propagation for neural networks with local renormalization layers, in: International Conference on Artificial Neural Networks, Springer, 2016, pp. 63–71.
  * [10] T. Kohonen, Self-organized formation of topologically correct feature maps, Biological cybernetics 43 (1) (1982) 59–69.
  * [11] B. Fritzke, Growing grid—a self-organizing network with constant neighborhood range and adaptation strength, Neural processing letters 2 (5) (1995) 9–13.
  * [12] M. Dittenbach, D. Merkl, A. Rauber, The growing hierarchical self-organizing map, in: Proceedings of the IEEE-INNS-ENNS International Joint Conference on Neural Networks. IJCNN 2000. Neural Computing: New Challenges and Perspectives for the New Millennium, Vol. 6, IEEE, 2000, pp. 15–19.
  * [13] D. E. Denning, An intrusion-detection model, IEEE Transactions on software engineering (2) (1987) 222–232.
  * [14] R. G. Bace, P. Mell, et al., Intrusion detection systems (2001).
  * [15] A. McDole, M. Gupta, M. Abdelsalam, S. Mittal, M. Alazab, Deep learning techniques for behavioural malware analysis in cloud iaas, in: Malware Analysis using Artificial Intelligence and Deep Learning, Springer, 2021.
  * [16] A. Sharma, S. K. Sahay, Evolution and detection of polymorphic and metamorphic malwares: A survey, arXiv preprint arXiv:1406.7061 (2014).
  * [17] V. Chandola, A. Banerjee, V. Kumar, Anomaly detection: A survey, ACM Comput. Surv. 41 (2009) 15:1–15:58.
  * [18] A. McDole, M. Abdelsalam, M. Gupta, S. Mittal, Analyzing cnn based behavioural malware detection techniques on cloud iaas, in: International Conference on Cloud Computing, Springer, 2020, pp. 64–79.
  * [19] M. Szczepański, M. Choraś, M. Pawlicki, R. Kozik, Achieving explainability of intrusion detection system by hybrid oracle-explainer approach, in: 2020 International Joint Conference on Neural Networks (IJCNN), IEEE, 2020, pp. 1–8.
  * [20] G. Pang, C. Ding, C. Shen, A. v. d. Hengel, Explainable deep few-shot anomaly detection with deviation networks, arXiv preprint arXiv:2108.00462 (2021).
  * [21] B. Subba, S. Biswas, S. Karmakar, Intrusion detection systems using linear discriminant analysis and logistic regression, in: 2015 Annual IEEE India Conference (INDICON), IEEE, 2015, pp. 1–6.
  * [22] B. Mahbooba, M. Timilsina, R. Sahal, M. Serrano, Explainable artificial intelligence (xai) to enhance trust management in intrusion detection systems using decision tree model, Complexity 2021 (2021).
  * [23] C. Langin, M. Wainer, S. Rahimi, Annabell island: a 3d color hexagonal som for visual intrusion detection, Internation Journal of Computer Science and Information Security 9 (1) (2011) 1–7.
  * [24] F. T. Liu, K. M. Ting, Z.-H. Zhou, Isolation forest, 2008 Eighth IEEE International Conference on Data Mining (2008) 413–422.
  * [25] B. Schölkopf, R. C. Williamson, A. Smola, J. Shawe-Taylor, J. C. Platt, Support vector method for novelty detection, in: NIPS, 1999.
  * [26] G. Zhang, Neural networks for classification: a survey, IEEE Transactions on Systems, Man, and Cybernetics, Part C (Applications and Reviews) 30 (4) (2000) 451–462.  doi:10.1109/5326.897072.
  * [27] J. D. Moore, W. R. Swartout, Explanation in expert systemss: A survey, Tech. rep., University of Southern California Marina Del Rey Information Sciences Inst (1988).
  * [28] E. H. Shortliffe, Mycin: a rule-based computer program for advising physicians regarding antimicrobial therapy selection., Tech. rep., Stanford Univ Calif Dept of Computer Science (1974).
  * [29] A. Holzinger, C. Biemann, C. S. Pattichis, D. B. Kell, What do we need to build explainable ai systems for the medical domain?, arXiv preprint arXiv:1712.09923 (2017).
  * [30] L. Lindsay, S. Coleman, D. Kerr, B. Taylor, A. Moorhead, Explainable artificial intelligence for falls prediction, in: International Conference on Advances in Computing and Data Sciences, Springer, 2020, pp. 76–84.
  * [31] Y. E. Chun, S. B. Kim, J. Y. Lee, J. H. Woo, Study on credit rating model using explainable ai, The Korean Data & Information Science Society 32 (2) (2021) 283–295.
  * [32] M. Han, J. Kim, Joint banknote recognition and counterfeit detection using explainable artificial intelligence, Sensors 19 (16) (2019) 3607.
  * [33] S. Neupane, I. A. Fernandez, W. Patterson, S. Mittal, S. Rahimi, A temporal anomaly detection system for vehicles utilizing functional working groups and sensor channels, IEEE International Conference on Collaboration and Internet Computing (IEEE CIC 2022) (2022).
  * [34] DARPA, Broad agency announcement explainable artificial intelligence (xai), DARPA-BAA-16-53 (2016) 7–8.
  * [35] S. R. Islam, W. Eberle, S. K. Ghafoor, A. Siraj, M. Rogers, Domain knowledge aided explainable artificial intelligence for intrusion detection and response, arXiv preprint arXiv:1911.09853 (2019).
  * [36] C. Wu, A. Qian, X. Dong, Y. Zhang, Feature-oriented design of visual analytics system for interpretable deep learning based intrusion detection, in: 2020 International Symposium on Theoretical Aspects of Software Engineering (TASE), IEEE, 2020, pp. 73–80.
  * [37] M. Wang, K. Zheng, Y. Yang, X. Wang, An explainable machine learning framework for intrusion detection systems, IEEE Access 8 (2020) 73127–73141.
  * [38] I. A. Khan, N. Moustafa, D. Pi, K. M. Sallam, A. Y. Zomaya, B. Li, A new explainable deep learning framework for cyber threat discovery in industrial iot networks, IEEE Internet of Things Journal (2021).
  * [39] K. Amarasinghe, K. Kenney, M. Manic, Toward explainable deep neural network based anomaly detection, in: 2018 11th International Conference on Human System Interaction (HSI), IEEE, 2018, pp. 311–317.
  * [40] D. E. Rumelhart, D. Zipser, Feature discovery by competitive learning, Cognitive science 9 (1) (1985) 75–112.
  * [41] C. Sammut, G. I. Webb, Encyclopedia of machine learning, Springer Science & Business Media, 2011.
  * [42] P. Lichodzijewski, A. N. Zincir-Heywood, M. I. Heywood, Host-based intrusion detection using self-organizing maps, in: Proceedings of the 2002 International Joint Conference on Neural Networks. IJCNN’02 (Cat. No. 02CH37290), Vol. 2, IEEE, 2002, pp. 1714–1719.
  * [43] E. De la Hoz, A. Ortiz García, J. Ortega Lopera, E. M. De La Hoz Correa, F. E. Mendoza Palechor, Implementation of an intrusion detection system based on self organizing map (2015).
  * [44] V. Pachghare, P. Kulkarni, D. M. Nikam, Intrusion detection system using self organizing maps, in: 2009 International Conference on Intelligent Agent & Multi-Agent Systems, IEEE, 2009, pp. 1–5.
  * [45] B. C. Rhodes, J. A. Mahaffey, J. D. Cannady, Multiple self-organizing maps for intrusion detection, in: Proceedings of the 23rd national information systems security conference, MD Press Baltimore, 2000, pp. 16–19.
  * [46] S. Albayrak, C. Scheel, D. Milosevic, A. Muller, Combining self-organizing map algorithms for robust and scalable intrusion detection, in: International Conference on Computational Intelligence for Modelling, Control and Automation and International Conference on Intelligent Agents, Web Technologies and Internet Commerce (CIMCA-IAWTIC’06), Vol. 2, IEEE, 2005, pp. 123–130.
  * [47] E. J. Palomo, E. Domínguez, R. M. Luque, J. Munoz, A self-organized multiagent system for intrusion detection, in: International Workshop on Agents and Data Mining Interaction, Springer, 2009, pp. 84–94.
  * [48] X. Qu, L. Yang, K. Guo, L. Ma, T. Feng, S. Ren, M. Sun, Statistics-enhanced direct batch growth self-organizing mapping for efficient dos attack detection, IEEE Access 7 (2019) 78434–78441.
  * [49] D. Ippoliti, X. Zhou, A-ghsom: An adaptive growing hierarchical self organizing map for network anomaly detection, Journal of Parallel and Distributed Computing 72 (12) (2012) 1576–1590.
  * [50] E. J. Palomo, E. Domínguez, R. M. Luque, J. Muñoz, A new ghsom model applied to network security, in: International Conference on Artificial Neural Networks, Springer, 2008, pp. 680–689.
  * [51] M. Salem, U. Buehler, An enhanced ghsom for ids, in: 2013 IEEE International Conference on Systems, Man, and Cybernetics, IEEE, 2013, pp. 1138–1143.
  * [52] Y. Yang, D. Jiang, M. Xia, Using improved ghsom for intrusion detection, Journal of Information Assurance and Security 5 (2010) 232–239.
  * [53] M. Bahrololum, M. Khaleghi, Anomaly intrusion detection system using gaussian mixture model, in: 2008 Third International Conference on Convergence and Hybrid Information Technology, Vol. 1, IEEE, 2008, pp. 1162–1167.
  * [54] M. Hammad, N. Hewahi, W. Elmedany, Mmm-rf: A novel high accuracy multinomial mixture model for network intrusion detection systems, Computers & Security (2022) 102777.
  * [55] M. Bitaab, S. Hashemi, Hybrid intrusion detection: Combining decision tree and gaussian mixture model, in: 2017 14th International ISC (Iranian Society of Cryptology) Conference on Information Security and Cryptology (ISCISC), IEEE, 2017, pp. 8–12.
  * [56] Z. Muda, W. Yassin, M. Sulaiman, N. Udzir, Intrusion detection based on k-means clustering and naïve bayes classification, in: 2011 7th international conference on information technology in Asia, IEEE, 2011, pp. 1–6.
  * [57] H. M. Tahir, A. M. Said, N. H. Osman, N. H. Zakaria, P. N. M. Sabri, N. Katuk, Oving k-means clustering using discretization technique in network intrusion detection system, in: 2016 3rd International Conference on Computer and Information Sciences (ICCOINS), IEEE, 2016, pp. 248–252.
  * [58] Z. Li, Y. Li, L. Xu, Anomaly intrusion detection method based on k-means clustering algorithm with particle swarm optimization, in: 2011 international conference of information technology, computer engineering and management sciences, Vol. 2, IEEE, 2011, pp. 157–161.
  * [59] E. Oja, S. Kaski, Kohonen maps, Elsevier, 1999.
  * [60] S. M. Guthikonda, Kohonen self-organizing maps, Wittenberg University 98 (2005).
  * [61] T. Kohonen, T. Honkela, Kohonen network, Scholarpedia 2 (1) (2007) 1568.
  * [62] L. Yuan, Implementation of self-organizing maps with Python, University of Rhode Island, 2018.
  * [63] J. Ong, S. M. R. Abidi, Data mining using self-organizing kohonen maps: A technique for effective data clustering & visualization, in: IC-AI, 1999.
  * [64] G. Breard, Evaluating self-organizing map quality measures as convergence criteria, 2017.
  * [65] Y. Liu, J. Sun, Q. Yao, S. Wang, K. Zheng, Y. Liu, A scalable heterogeneous parallel som based on mpi/cuda, in: Asian Conference on Machine Learning, PMLR, 2018, pp. 264–279.
  * [66] D. Alahakoon, S. Halgamuge, B. Srinivasan, A self-growing cluster development approach to data mining, in: SMC’98 Conference Proceedings. 1998 IEEE International Conference on Systems, Man, and Cybernetics (Cat. No.98CH36218), Vol. 3, 1998, pp. 2901–2906 vol.3.  doi:10.1109/ICSMC.1998.725103.
  * [67] M. Vasighi, H. Amini, A directed batch growing approach to enhance the topology preservation of self-organizing map, Applied Soft Computing 55 (2017) 424–435.
  * [68] A. J. Myles, R. N. Feudale, Y. Liu, N. A. Woody, S. D. Brown, An introduction to decision tree modeling, Journal of Chemometrics 18 (2004) 275–285.  doi:10.1002/CEM.873.
  * [69] J. R. Quinlan, Simplifying decision trees, International Journal of Man-Machine Studies 27 (1987) 221–234.  doi:10.1016/S0020-7373(87)80053-6.
  * [70] Y. Mansour, Pessimistic decision tree pruning based on tree size, in: Machine Learning-International Workshop then Conference, Citeseer, 1997, pp. 195–201.
  * [71] M. Kearns, Y. Mansour, A fast, bottom-up decision tree pruning algorithm with near-optimal generalization, in: ICML, 1998.
  * [72] L. Hamel, C. Brown, Bayesian probability approach to feature significance for infrared spectra of bacteria, Applied Spectroscopy 66 (2012) 48–59.  doi:10.1366/10-06155.
  * [73] M. Tavallaee, E. Bagheri, W. Lu, A. A. Ghorbani, A detailed analysis of the kdd cup 99 data set, 2009, pp. 1–6.  doi:10.1109/CISDA.2009.5356528.
  * [74] I. Sharafaldin, A. H. Lashkari, A. A. Ghorbani, Toward generating a new intrusion detection dataset and intrusion traffic characterization., ICISSp 1 (2018) 108–116.
  * [75] M. Carvalho, J. DeMott, R. Ford, D. A. Wheeler, Heartbleed 101, IEEE security & privacy 12 (4) (2014) 63–67.
  * [76] A. H. Lashkari, Y. Zang, G. Owhuo, M. Mamun, G. Gil, Cicflowmeter (2017).
  * [77] T. Kohonen, The self-organizing map, Neurocomputing 21 (1998) 1–6.  doi:https://doi.org/10.1016/S0925-2312(98)00030-7.
  * [78] J. Lampinen, E. Oja, Clustering properties of hierarchical self-organizing maps, Journal of Mathematical Imaging and Vision 2 (1992) 261–272.  doi:10.1007/BF00118594.
URL https://doi.org/10.1007/BF00118594

  * [79] L. Hamel, Som quality measures: An efficient statistical approach, Vol. 428, Springer Verlag, 2016, pp. 49–59.  doi:10.1007/978-3-319-28518-4.
  * [80] Self-organizing map convergence, Int. J. Serv. Sci. Manag. Eng. Technol. 9 (2018) 61–84.  doi:10.4018/IJSSMET.2018040103.
URL https://doi.org/10.4018/IJSSMET.2018040103

  * [81] C. S. Wickramasinghe, K. Amarasinghe, D. L. Marino, C. Rieger, M. Manic, Explainable unsupervised machine learning for cyber-physical systems, IEEE Access 9 (2021) 131824–131843.
  * [82] L. Hamel, C. Brown, Improved interpretability of the unified distance matrix with connected components, 7th International Conference on Data Mining (DMIN’11) (4 2012).
  * [83] Y. Jia, M. Wang, Y. Wang, Network intrusion detection algorithm based on deep neural network, IET Information Security 13 (1) (2019) 48–53.
  * [84] L. Mohammadpour, T. C. Ling, C. S. Liew, C. Y. Chong, A convolutional neural network for network intrusion detection system, Proceedings of the Asia-Pacific Advanced Network 46 (0) (2018) 50–55.
  * [85] C. Xu, J. Shen, X. Du, F. Zhang, An intrusion detection system using a deep neural network with gated recurrent units, IEEE Access 6 (2018) 48697–48707.
  * [86] T. Su, H. Sun, J. Zhu, S. Wang, Y. Li, Bat: Deep learning methods on network intrusion detection using nsl-kdd dataset, IEEE Access 8 (2020) 29575–29585.
  * [87] A. S. Khan, Z. Ahmad, J. Abdullah, F. Ahmad, A spectrogram image-based network anomaly detection system using deep convolutional neural network, IEEE Access 9 (2021) 87079–87093.
  * [88] S. Almutlaq, A. Derhab, M. M. Hassan, K. Kaur, Two-stage intrusion detection system in intelligent transportation systems using rule extraction methods from deep neural networks, IEEE Transactions on Intelligent Transportation Systems (2022).
  * [89] M. Abdel-Basset, H. Hawash, R. K. Chakrabortty, M. J. Ryan, Semi-supervised spatiotemporal deep learning for intrusions detection in iot networks, IEEE Internet of Things Journal 8 (15) (2021) 12251–12265.
  * [90] A. H. Halbouni, T. S. Gunawan, M. Halbouni, F. A. A. Assaig, M. R. Effendi, N. Ismail, Cnn-ids: Convolutional neural network for network intrusion detection system, in: 2022 8th International Conference on Wireless and Telematics (ICWT), IEEE, 2022, pp. 1–4.