An Explainable Outlier Detection-based Data Cleaning Approach for Intrusion Detection

The effectiveness of machine learning (ML)-based intrusion detection systems (IDSs) for detecting widespread cyberattacks on critical infrastructure and government systems has been demonstrated in recent years. Nevertheless, with ML models becoming more complex, people can hardly understand their decisions. Further, most works on model explanations focus on analyzing the ML model itself. However, data cleaning is also vital in influencing the model's detection behavior. On the other hand, data cleaning for ML-based IDSs is challenging because modern IDS datasets may contain outliers that affect the training stage. In this work, we propose an explainable data cleaning approach for intrusion detection, which can effectively perform explainable isolation forest-based outlier detection in the data preprocessing stage for intrusion detection. Through experiments on real-world network intrusion datasets, we evaluate the effectiveness of our approach. Experiment results demonstrate that eliminating outliers improves intrusion detection and that data cleaning using outlier detection is explainable.