An explainable-by-design ensemble learning system to detect unknown network attacks

Security analysts have to deal with a large volume of network traffic to identify and prevent cyber attacks daily. To assist them in this task, network intrusion detection systems (NIDSs) monitor the network and raise alarms when they identify suspicious events or anomalies. We investigate unsupervised learning techniques to analyze network traffic captures because they are more likely to detect unknown attacks. There is a wide variety of unsupervised learning algorithms, whose results seem complementary, but their lack of explainability makes it difficult to find out which one of their results is right. Our system intends to reconstruct attack patterns from a set of unsupervised anomaly detectors outputs, and show them to security analysts. Therefore, we introduce an explainable-by-design system to detect attacks on networks, and evaluated its accuracy on the CSE-CIC-IDS2018 dataset [17]