This paper addresses trust issues created from the ubiquity of black box
algorithms and surrogate explainers in Explainable Intrusion Detection Systems
(X-IDS). While Explainable Artificial Intelligence (XAI) aims to enhance
transparency, black box surrogate explainers, such as Local Interpretable
Model-Agnostic Explanation (LIME) and SHapley Additive exPlanation (SHAP), are
difficult to trust. The black box nature of these surrogate explainers makes
the process behind explanation generation opaque and difficult to understand.
To avoid this problem, one can use transparent white box algorithms such as
Rule Extraction (RE). There are three types of RE algorithms: pedagogical,
decompositional, and eclectic. Pedagogical methods offer fast but untrustworthy
white-box explanations, while decompositional RE provides trustworthy
explanations with poor scalability. This work explores eclectic rule
extraction, which strikes a balance between scalability and trustworthiness. By
combining techniques from pedagogical and decompositional approaches, eclectic
rule extraction leverages the advantages of both, while mitigating some of
their drawbacks. The proposed Hybrid X-IDS architecture features eclectic RE as
a white box surrogate explainer for black box Deep Neural Networks (DNN). The
presented eclectic RE algorithm extracts human-readable rules from hidden
layers, facilitating explainable and trustworthy rulesets. Evaluations on
UNSW-NB15 and CIC-IDS-2017 datasets demonstrate the algorithm's ability to
generate rulesets with 99.9% accuracy, mimicking DNN outputs. The contributions
of this work include the hybrid X-IDS architecture, the eclectic rule
extraction algorithm applicable to intrusion detection datasets, and a thorough
analysis of performance and explainability, demonstrating the trade-offs
involved in rule extraction speed and accuracy.

该研究论文探讨了黑盒算法和替代解释器在可解释入侵检测系统（X-IDS）中引发的信任问题。通过将教学法和分解法综合应用于课程，该文介绍了一种混合的规则提取算法，从隐藏层中提取出可信任的规则集，用于黑盒深度神经网络（DNN）的解释。评估结果表明，这种算法能够生成与 DNN 输出相似的规则集，具有 99.9% 的准确率，并在解释性和性能方面进行了全面分析，展示了规则提取速度和准确性之间的权衡。

基于深度神经网络的入侵检测系统的可解释性的多元规则提取

Eclectic Rule Extraction for Explainability of Deep Neural Network based  Intrusion Detection Systems

Many problems in computer vision have recently been tackled using models
whose predictions cannot be easily interpreted, most commonly deep neural
networks. Surrogate explainers are a popular post-hoc interpretability method
to further understand how a model arrives at a particular prediction. By
training a simple, more interpretable model to locally approximate the decision
boundary of a non-interpretable system, we can estimate the relative importance
of the input features on the prediction. Focusing on images, surrogate
explainers, e.g., LIME, generate a local neighbourhood around a query image by
sampling in an interpretable domain. However, these interpretable domains have
traditionally been derived exclusively from the intrinsic features of the query
image, not taking into consideration the manifold of the data the
non-interpretable model has been exposed to in training (or more generally, the
manifold of real images). This leads to suboptimal surrogates trained on
potentially low probability images. We address this limitation by aligning the
local neighbourhood on which the surrogate is trained with the original
training data distribution, even when this distribution is not accessible. We
propose two approaches to do so, namely (1) altering the method for sampling
the local neighbourhood and (2) using perceptual metrics to convey some of the
properties of the distribution of natural images.

本文提出了对生成解释性数据的 surrogate explainers 的限制进行修正的方法，基于深度神经网络中的解释性模型，通过使用感知度量并将采样的局部邻域与原始培训数据分布对齐，训练一个局部可解释的模型，以了解模型是如何得出特定预测结果的。

基于自然图像统计的采样改进了本地代理解释器

Sampling Based On Natural Image Statistics Improves Local Surrogate Explainers

Surrogate explainers of black-box machine learning predictions are of
paramount importance in the field of eXplainable Artificial Intelligence since
they can be applied to any type of data (images, text and tabular), are
model-agnostic and are post-hoc (i.e., can be retrofitted). The Local
Interpretable Model-agnostic Explanations (LIME) algorithm is often mistakenly
unified with a more general framework of surrogate explainers, which may lead
to a belief that it is the solution to surrogate explainability. In this paper
we empower the community to "build LIME yourself" (bLIMEy) by proposing a
principled algorithmic framework for building custom local surrogate explainers
of black-box model predictions, including LIME itself. To this end, we
demonstrate how to decompose the surrogate explainers family into
algorithmically independent and interoperable modules and discuss the influence
of these component choices on the functional capabilities of the resulting
explainer, using the example of LIME.

本文提出一种算法框架 bLIMEy，用于构建定制的本地替代解释器，其中包括 LIME，该框架独立且可互操作，并讨论了组件选择对结果解释器功能能力的影响。