Explainable Machine Learning for Cybersecurity Threat Analytics in Edge Computing: A Comprehensive Analysis for Security Framework

Abstract

Internet of Things (IoT), edge computing, smart systems & increasingly complex interconnected digital infrastructures have dramatically expanded the volume, variety & complexity of network traffic. While edge computing decreases the latency of communication by bringing computational resources closer to the data sources, it is also a distributed network with limited resources which presents significant cybersecurity challenges. Traditional signature-based IDSs work well against known attack patterns and might not be able to detect new or changing attacks. Machine learning (ML) has thus become a crucial method for automated intrusion detection as complex patterns in network traffic can be learned, and activities classified as benign or malicious. Although many ML intrusion detection systems (IDS) can be used to predict attacks so they are still black-box systems. Because they are not that widely interpretable, cybersecurity analysts have difficulty in understanding the reason behind the classification of a certain network flow as malicious. Explainable Artificial Intelligence (XAI) is a potential solution because it allows to generate human understandable explanations for the predictions of ML. Current review focuses on the use of Random Forest (RF), Extreme Gradient Boosting (XGBoost), SHapley Additive exPlanations (SHAP) & Local Interpretable Model-Agnostic Explanations (LIME) for intrusion detection in particular for the CIC-IDS 2017 dataset & edge-computing environments. In this review features, pros, cons, computation & explainability of these approaches are compared. It further discusses performance evaluation metrics, feature importance, global, local explanations & challenges associated with deploying intelligent IDS models at the edge. This review paper reveals a gap in research on the simultaneous attainment of detection performance, computational efficiency & interpretability. A combined RF/XGBoost & SHAP/LIME approach is therefore proposed as a potential path towards transparent and effective ID systems.