The prevailing approaches in Network Intrusion Detection Systems (NIDS) are
often hampered by issues such as high resource consumption, significant
computational demands, and poor interpretability. Furthermore, these systems
generally struggle to identify novel, rapidly changing cyber threats. This
paper delves into the potential of incorporating Neurosymbolic Artificial
Intelligence (NSAI) into NIDS, combining deep learning's data-driven strengths
with symbolic AI's logical reasoning to tackle the dynamic challenges in
cybersecurity, which also includes detailed NSAI techniques introduction for
cyber professionals to explore the potential strengths of NSAI in NIDS. The
inclusion of NSAI in NIDS marks potential advancements in both the detection
and interpretation of intricate network threats, benefiting from the robust
pattern recognition of neural networks and the interpretive prowess of symbolic
reasoning. By analyzing network traffic data types and machine learning
architectures, we illustrate NSAI's distinctive capability to offer more
profound insights into network behavior, thereby improving both detection
performance and the adaptability of the system. This merging of technologies
not only enhances the functionality of traditional NIDS but also sets the stage
for future developments in building more resilient, interpretable, and dynamic
defense mechanisms against advanced cyber threats. The continued progress in
this area is poised to transform NIDS into a system that is both responsive to
known threats and anticipatory of emerging, unseen ones.

融合神经符号人工智能（NSAI）和传统网络入侵检测系统（NIDS）的研究，通过分析网络流量数据类型和机器学习架构，展示了 NSAI 在提供对网络行为更深入洞察力方面的独特能力，从而改善了检测性能和系统的适应性。这种技术的融合不仅增强了传统 NIDS 的功能，也为构建更具弹性、可解释性和动态防御机制以应对先进网络威胁的未来发展奠定了基础。

神经符号 AI 在网络入侵检测中的协同方法

A Synergistic Approach In Network Intrusion Detection By Neurosymbolic  AI

Identifying the features learned by neural networks is a core challenge in
mechanistic interpretability. Sparse autoencoders (SAEs), which learn a sparse,
overcomplete dictionary that reconstructs a network's internal activations,
have been used to identify these features. However, SAEs may learn more about
the structure of the datatset than the computational structure of the network.
There is therefore only indirect reason to believe that the directions found in
these dictionaries are functionally important to the network. We propose
end-to-end (e2e) sparse dictionary learning, a method for training SAEs that
ensures the features learned are functionally important by minimizing the KL
divergence between the output distributions of the original model and the model
with SAE activations inserted. Compared to standard SAEs, e2e SAEs offer a
Pareto improvement: They explain more network performance, require fewer total
features, and require fewer simultaneously active features per datapoint, all
with no cost to interpretability. We explore geometric and qualitative
differences between e2e SAE features and standard SAE features. E2e dictionary
learning brings us closer to methods that can explain network behavior
concisely and accurately. We release our library for training e2e SAEs and
reproducing our analysis at this https URL

通过端到端稀疏字典学习方法，我们能够训练稀疏自编码器 (SAEs)，从而确保学习到的特征对网络功能起到重要作用，实现了更好的网络性能解释、特征数量的减少以及样本中同时活动的特征数量的减少。

通过端到端稀疏字典学习识别功能重要特征

Identifying Functionally Important Features with End-to-End Sparse  Dictionary Learning

To gain a deeper understanding of the behavior and learning dynamics of
(deep) artificial neural networks, it is valuable to employ mathematical
abstractions and models. These tools provide a simplified perspective on
network performance and facilitate systematic investigations through
simulations. In this paper, we propose utilizing the framework of stochastic
processes, which has been underutilized thus far.
Our approach models activation patterns of thresholded nodes in (deep)
artificial neural networks as stochastic processes. We focus solely on
activation frequency, leveraging neuroscience techniques used for real neuron
spike trains. During a classification task, we extract spiking activity and use
an arrival process following the Poisson distribution.
We examine observed data from various artificial neural networks in image
recognition tasks, fitting the proposed model's assumptions. Through this, we
derive parameters describing activation patterns in each network. Our analysis
covers randomly initialized, generalizing, and memorizing networks, revealing
consistent differences across architectures and training sets.
Calculating Mean Firing Rate, Mean Fano Factor, and Variances, we find stable
indicators of memorization during learning, providing valuable insights into
network behavior. The proposed model shows promise in describing activation
patterns and could serve as a general framework for future investigations. It
has potential applications in theoretical simulations, pruning, and transfer
learning.

使用随机过程模型神经网络中的激活模式，从而提供关于网络行为的有价值洞见。

探索随机过程来理解人工神经网络中的激活模式

Understanding Activation Patterns in Artificial Neural Networks by  Exploring Stochastic Processes

Agnostophobia, the fear of the unknown, can be experienced by deep learning
engineers while applying their networks to real-world applications.
Unfortunately, network behavior is not well defined for inputs far from a
networks training set. In an uncontrolled environment, networks face many
instances that are not of interest to them and have to be rejected in order to
avoid a false positive. This problem has previously been tackled by researchers
by either a) thresholding softmax, which by construction cannot return "none of
the known classes", or b) using an additional background or garbage class. In
this paper, we show that both of these approaches help, but are generally
insufficient when previously unseen classes are encountered. We also introduce
a new evaluation metric that focuses on comparing the performance of multiple
approaches in scenarios where such unseen classes or unknowns are encountered.
Our major contributions are simple yet effective Entropic Open-Set and
Objectosphere losses that train networks using negative samples from some
classes. These novel losses are designed to maximize entropy for unknown inputs
while increasing separation in deep feature space by modifying magnitudes of
known and unknown samples. Experiments on networks trained to classify classes
from MNIST and CIFAR-10 show that our novel loss functions are significantly
better at dealing with unknown inputs from datasets such as Devanagari,
NotMNIST, CIFAR-100, and SVHN.

本文介绍了新的损失函数及其在深度学习网络中的应用，能够有效解决输入数据不在网络训练集中的分类问题，并在 MNIST 和 CIFAR-10 数据集上进行了实验。