Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Feature Attribution in 5G Intrusion Detection: A Statistical vs. Logic-Based Comparison

Federica Uccello, Simin Nadjm-Tehrani

Abstract

With the rise of fifth-generation (5G) networks in critical applications, it is urgent to move from detection of malicious activity to systems capable of providing a reliable verdict suitable for mitigation. In this regard, understanding and interpreting machine learning (ML) models' security alerts is crucial for enabling actionable incident response orchestration. Explainable Artificial Intelligence (XAI) techniques are expected to enhance trust by providing insights into why alerts are raised. Under the umbrella of XAI, interpretability of outcomes is crucially dependent on understanding the influence of specific inputs, referred to as feature attribution. {A dominant approach to feature attribution statistically associates feature sets that can be correlated to a given alert. This paper investigates its merits against the backdrop of criticism from recent literature, in comparison with feature attribution based on logic. We extensively study two methods, SHAP and VoTE-XAI, as representatives of each feature attribution approach by analyzing their interpretations of alerts generated by an XGBoost model across three 5G-relevant datasets (5G-NIDD, MSA, and PFCP) covering multiple attack scenarios. We identify three metrics for assessing explanations: sparsity, how concise they are; stability, how consistent they are across samples from the same attack type; and efficiency, how fast an explanation is generated. Our results reveal that logic-based attributions are consistently more sparse and stable across alerts. More importantly, we found a significant divergence between features selected by SHAP and VoTE-XAI. However, none of the top-ranked features selected by SHAP were missed by VoTE-XAI. Finally, we analyze the efficiency of both methods, discussing their suitability for real-time security monitoring even in high-dimensional 5G environments (478 features).

Feature Attribution in 5G Intrusion Detection: A Statistical vs. Logic-Based Comparison

Abstract

With the rise of fifth-generation (5G) networks in critical applications, it is urgent to move from detection of malicious activity to systems capable of providing a reliable verdict suitable for mitigation. In this regard, understanding and interpreting machine learning (ML) models' security alerts is crucial for enabling actionable incident response orchestration. Explainable Artificial Intelligence (XAI) techniques are expected to enhance trust by providing insights into why alerts are raised. Under the umbrella of XAI, interpretability of outcomes is crucially dependent on understanding the influence of specific inputs, referred to as feature attribution. {A dominant approach to feature attribution statistically associates feature sets that can be correlated to a given alert. This paper investigates its merits against the backdrop of criticism from recent literature, in comparison with feature attribution based on logic. We extensively study two methods, SHAP and VoTE-XAI, as representatives of each feature attribution approach by analyzing their interpretations of alerts generated by an XGBoost model across three 5G-relevant datasets (5G-NIDD, MSA, and PFCP) covering multiple attack scenarios. We identify three metrics for assessing explanations: sparsity, how concise they are; stability, how consistent they are across samples from the same attack type; and efficiency, how fast an explanation is generated. Our results reveal that logic-based attributions are consistently more sparse and stable across alerts. More importantly, we found a significant divergence between features selected by SHAP and VoTE-XAI. However, none of the top-ranked features selected by SHAP were missed by VoTE-XAI. Finally, we analyze the efficiency of both methods, discussing their suitability for real-time security monitoring even in high-dimensional 5G environments (478 features).

Paper Structure

This paper contains 37 sections, 3 equations, 5 figures, 10 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Explainable AI for Intrusion Detection
  4. Explainable AI and Model Performance
  5. Explainable AI for 5G and Beyond
  6. Studies on Feature Attribution
  7. Background
  8. Explainable AI Scope and Concepts
  9. Statistical Feature Attribution and SHAP
  10. Logic-based Feature Attribution and VoTE-XAI
  11. Method
  12. Research Questions
  13. Investigation Approach
  14. Incident-response Case Studies
  15. Dataset Description
  16. ...and 22 more sections

Figures (5)

  • Figure 1: High-level representation of the investigation approach.
  • Figure 2: SHAP stability across different attacks: (a) UDPFlood, (b) SYNFlood, (c) Bidding down with TAUReject, (d) Authentication relay attack, (e) PFCP Session Deletion Flood, (f) PFCP Session Modification Flood (DROP).
  • Figure 3: VoTE-XAI stability for (a) 5G-NIDD, (b) MSA, and (c) PFCP datasets.
  • Figure 4: Divergence between VoTE-XAI feature importance (green bars) and SHAP attribution (blue bars) across six attack types. The y-axes are in logarithmic scale.
  • Figure 5: Efficiency Evaluation for SHAP and VoTE-XAI (single minimal explanation) for the 5G-NIDD (a), MSA (b), and PFCP (c) datasets.