Explainable AI for Enhancing IDS Against Advanced Persistent Kill Chain

TL;DR

This paper introduces a lightweight, explainable IDS that uses feature selection with SHAP and XGBoost to effectively detect APTs at different phases, achieving high accuracy with fewer features.

Contribution

It presents a novel feature selection and classification approach combining SHAP and XGBoost for phase-specific APT detection in IDS.

Findings

Achieved 94% macro F1-score and 93% recall on SCVIC-APT-2021 dataset.

Reduced feature set to only 12 influential features from 77.

Improved detection performance over standard techniques.

Abstract

Advanced Persistent Threats (APTs) represent a sophisticated and persistent cy-bersecurity challenge, characterized by stealthy, multi-phase, and targeted attacks aimed at compromising information systems over an extended period. Develop-ing an effective Intrusion Detection System (IDS) capable of detecting APTs at different phases relies on selecting network traffic features. However, not all of these features are directly related to the phases of APTs. Some network traffic features may be unrelated or have limited relevance to identifying malicious ac-tivity. Therefore, it is important to carefully select and analyze the most relevant features to improve the IDS performance. This work proposes a feature selection and classification model that integrates two prominent machine learning algo-rithms: SHapley Additive exPlanations (SHAP) and Extreme Gradient Boosting (XGBoost). The aim is to develop lightweight IDS based on a selected minimum number of influential features for detecting APTs at various phases. The pro-posed method also specifies the relevant features for each phase of APTs inde-pendently. Extensive experimental results on the SCVIC-APT-2021 dataset indi-cated that our proposed approach has improved performance compared to other standard techniques. Specifically, both the macro-average F1-score and recall reached 94% and 93 %, respectively, while reducing the complexity of the detec-tion model by selecting only 12 features out of 77.