Recent advancements in Intrusion Detection Systems (IDS), integrating
Explainable AI (XAI) methodologies, have led to notable improvements in system
performance via precise feature selection. However, a thorough understanding of
cyber-attacks requires inherently explainable decision-making processes within
IDS. In this paper, we present the Interpretable Generalization Mechanism (IG),
poised to revolutionize IDS capabilities. IG discerns coherent patterns, making
it interpretable in distinguishing between normal and anomalous network
traffic. Further, the synthesis of coherent patterns sheds light on intricate
intrusion pathways, providing essential insights for cybersecurity forensics.
By experiments with real-world datasets NSL-KDD, UNSW-NB15, and UKM-IDS20, IG
is accurate even at a low ratio of training-to-test. With 10%-to-90%, IG
achieves Precision (PRE)=0.93, Recall (REC)=0.94, and Area Under Curve
(AUC)=0.94 in NSL-KDD; PRE=0.98, REC=0.99, and AUC=0.99 in UNSW-NB15; and
PRE=0.98, REC=0.98, and AUC=0.99 in UKM-IDS20. Notably, in UNSW-NB15, IG
achieves REC=1.0 and at least PRE=0.98 since 40%-to-60%; in UKM-IDS20, IG
achieves REC=1.0 and at least PRE=0.88 since 20%-to-80%. Importantly, in
UKM-IDS20, IG successfully identifies all three anomalous instances without
prior exposure, demonstrating its generalization capabilities. These results
and inferences are reproducible. In sum, IG showcases superior generalization
by consistently performing well across diverse datasets and training-to-test
ratios (from 10%-to-90% to 90%-to-10%), and excels in identifying novel
anomalies without prior exposure. Its interpretability is enhanced by coherent
evidence that accurately distinguishes both normal and anomalous activities,
significantly improving detection accuracy and reducing false alarms, thereby
strengthening IDS reliability and trustworthiness.

通过互联网入侵检测系统（IDS）与可解释人工智能（XAI）的集成，最近取得了显著的性能提升，通过精确的特征选择。然而，深入了解网络攻击需要 IDS 内部可解释的决策过程。本文提出了易于解释的泛化机制（IG），具有革新 IDS 能力的潜力。IG 区分出一致的模式，从而使其具有解释能力，可以区分正常和异常的网络流量。此外，一致模式的合成揭示了复杂的入侵路径，为网络安全取证提供了重要见解。通过与实际数据集 NSL-KDD、UNSW-NB15 和 UKM-IDS20 的实验，IG 即使在低比例的训练和测试中也能取得较高的准确性。在 NSL-KDD 中，当比例为 10% 至 90% 时，IG 的准确率（PRE）为 0.93，召回率（REC）为 0.94，曲线下面积（AUC）为 0.94；在 UNSW-NB15 中，IG 的 PRE 为 0.98，REC 为 0.99，AUC 为 0.99；在 UKM-IDS20 中，IG 的 PRE 为 0.98，REC 为 0.98，AUC 为 0.99。值得注意的是，在 UNSW-NB15 中，IG 在 40% 至 60% 时实现 REC=1.0，至少 PRE=0.98；在 UKM-IDS20 中，IG 在 20% 至 80% 时实现 REC=1.0，至少 PRE=0.88。在 UKM-IDS20 中，IG 成功识别出所有三个异常实例，说明其具有泛化能力。这些结果和推论是可复现的。总之，IG 通过在各种数据集和训练和测试比例（从 10% 至 90% 到 90% 至 10%）之间始终表现出色，并且在没有先前接触的情况下优秀地识别新的异常，展示了卓越的泛化能力。其可解释性通过准确区分正常和异常活动的一致证据得到增强，显著提高了检测准确性，降低了误报，从而增强了 IDS 的可靠性和可信度。