Search

The escalating complexity of malicious digital activities highlights the necessity for dependable and transparent intrusion detection systems (IDS) to preserve network integrity. Although machine learning frameworks like Decision Tree (DT), Random Forest (RF), k-Nearest Neighbors (K-NN), and XGBoost demonstrate exceptional capabilities in identifying malicious behavior, their inner mechanics grow increasingly opaque as structural complexity and predictive precision expand, creating challenges for high-stakes safety operations. Local Interpretable Model-agnostic Explanations (LIME) is frequently deployed to mitigate this issue; nevertheless, its dependency on Gaussian distributions when generating data variations often fails to capture the non-linear and disproportionate traits of frameworks like CIC-IDS-2018. To overcome these limitations, we introduce an adapted LIME variation strategy utilizing Weibull, Gamma, Beta, and Pareto distributions to more accurately represent the attributes of network telemetry. Our framework enhances the consistency of diverse machine learning systems optimized on CIC-IDS repositories, yielding more constructive and dependable rationales for predictive outputs. These proposed algorithmic adjustments yield a gain in explanatory fidelity of up to 78% relative to the standard normal distribution framework. Variations rooted in the Pareto distribution deliver the most optimal outcomes. Across all evaluated distributions, the Pareto framework consistently generated the peak explanation fidelity and consistency, notably for K-NN (R^2 = 0.9971, S = 0.9907) and DT (R^2 = 0.9267, S = 0.9797). This demonstrates that heavy-tailed distributions align effectively with actual network operational trends, minimizing the discrepancy in attribute significance justifications and rendering them more resilient.

Graph neural networks (GNNs) have been successfully deployed across numerous practical domains, yet the precise mechanisms underlying their operations remain largely opaque. In response to this lack of clarity and to encourage the deployment of reliable AI systems, a variety of GNN explanation tools have been developed. Nonetheless, current interpretation techniques frequently encounter severe bottlenecks, including: (1) explanations that are restricted to localized individual instances; (2) poor generalizability when applied to unfamiliar graph structures; (3) the risk of creating structurally invalid graphs; and (4) confinement to specific task domains (such as only node or only graph classification). To resolve these deficiencies, we introduce a novel interpretation framework, GAN-GNNExplainer, which integrates a generator to construct explanations alongside a discriminator to supervise the production stage, thereby enhancing output dependability. Although advantageous, GAN-GNNExplainer still exhibits limitations in producing highly faithful explanations and shows suboptimal performance when tested on empirical datasets. To rectify these weaknesses, we present ACGAN-GNNExplainer, an advanced iteration that enhances GAN-GNNExplainer by utilizing a more robust discriminator to continuously monitor the generation phase, which yields explanatory outputs that are both dependable and faithful. Comprehensive empirical evaluations conducted on both artificial and empirical graph datasets confirm that our proposed methodologies outperform conventional GNN explanation frameworks.