Interpreting GNN-based IDS Detections Using Provenance Graph Structural Features. (arXiv:2306.00934v2 [cs.CR] UPDATED)

The black-box nature of complex Neural Network (NN)-based models has hindered
their widespread adoption in security domains due to the lack of logical
explanations and actionable follow-ups for their predictions. To enhance the
transparency and accountability of Graph Neural Network (GNN) security models
used in system provenance analysis, we propose PROVEXPLAINER, a framework for
projecting abstract GNN decision boundaries onto interpretable feature spaces.

We first replicate the decision-making process of GNNbased security models
using simpler and explainable models such as …

accountability actionable adoption analysis box detections domains features ids nature network neural network predictions provenance provenance analysis security security models system transparency transparency and accountability ups