Authors:
Anne Borcherding
1
;
2
;
Lukas Feldmann
3
;
Markus Karch
1
;
Ankush Meshram
2
;
4
and
Jürgen Beyerer
1
;
2
;
4
Affiliations:
1
Fraunhofer Institute of Optronics, System Technologies and Image Exploitation IOSB, Fraunhofer Center for Machine Learning, Karlsruhe, Germany
;
2
KASTEL Security Research Labs, Karlsruhe, Germany
;
3
Siemens AG, Germany
;
4
Vision and Fusion Laboratory (IES), Karlsruhe Institute of Technology (KIT), Karlsruhe, Germany
Keyword(s):
Network Intrusion Detection, Machine Learning, Critical Infrastructure, Industrial Control Systems, Model Inspection.
Abstract:
It is crucial in an industrial network to understand how and why a intrusion detection system detects, classifies, and reports intrusions. With the ongoing introduction of machine learning into the research area of intrusion detection, this understanding gets even more important since the used systems often appear as a black-box for the user and are no longer understandable in an intuitive and comprehensible way. We propose a novel approach to understand the internal characteristics of a machine learning based network intrusion detection system. This approach includes methods to understand which data sources the system uses, to evaluate whether the system uses linear or non-linear classification approaches, and to find out which underlying machine learning model is implemented in the system. Our evaluation on two publicly available industrial datasets shows that the detection of the data source and the differentiation between linear and non-linear models is possible with our approach
. In addition, the identification of the underlying machine learning model can be accomplished with statistical significance for non-linear models. The information made accessible by our approach helps to develop a deeper understanding of the functioning of a network intrusion detection system, and contributes towards developing transparent machine learning based intrusion detection approaches.
(More)