A Comparative Analysis of DNN-based White-Box Explainable AI Methods in Network Security

A Comparative Analysis of DNN-based White-Box Explainable AI Methods in Network Security | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article A Comparative Analysis of DNN-based White-Box Explainable AI Methods in Network Security Osvaldo Arreche, Mustafa Abdallah This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-4790512/v1 This work is licensed under a CC BY 4.0 License Status: Posted Version 1 posted You are reading this latest preprint version Abstract New research focuses on creating artificial intelligence (AI) solutions for network intrusion detection systems (NIDS), drawing its inspiration from the ever-growing number of intrusions on networked systems, increasing its complexity and intelligibility. Hence, the use of explainable AI (XAI) techniques in real-world intrusion detection systems comes from the requirement to comprehend and elucidate black-box AI models to security analysts. In an effort to meet such requirements, this paper focuses on applying and evaluating White-Box XAI techniques (particularly LRP, IG, and DeepLift) for NIDS via an end-to-end framework for neural network models, using three widely used network intrusion datasets (NSL-KDD, CICIDS-2017, and RoEduNet-SIMARGL2021), assessing its global and local scopes, and examining six distinct assessment measures (descriptive accuracy, sparsity, stability, robustness, efficiency, and completeness). We also compare the performance of white-box XAI methods with black-box XAI methods. The results show that using White-box XAI techniques scores high in robustness and completeness, which are crucial metrics for IDS. Moreover, the source codes for the programs developed for our XAI evaluation framework are available to be improved and used by the research community. Explainable AI XAI Evaluation Intrusion Detection Systems LRP Integrated Gradients Network Security DeepLift White-box AI NSL-KDD CICIDS-2017 RoEduNet-SIMARGL2021 Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Posted Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-4790512","acceptedTermsAndConditions":true,"allowDirectSubmit":true,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":342184938,"identity":"c3ce21c2-ec3e-41d8-8d60-681783b0bc55","order_by":0,"name":"Osvaldo Arreche","email":"","orcid":"","institution":"Purdue University in Indianapolis","correspondingAuthor":false,"prefix":"","firstName":"Osvaldo","middleName":"","lastName":"Arreche","suffix":""},{"id":342184939,"identity":"8b6bbb15-19d5-4cf9-b772-01c05475b9a4","order_by":1,"name":"Mustafa Abdallah","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAA20lEQVRIiWNgGAWjYDACCQYDhgcFDDz8IA4PWCiBCC0JBgxykg2kajE2OECsFv7ZzRs/JBjYJW6+3WP24W2bDQM/e44BfkvuHCuWSDBITtx254zxzLltaQySPW/wa2G4kWMA1MKcuO1GjjEzb9thBoMbBGyRB6r8kWBQn7h5BljLfwZ7QlqAZpoBbTlsbCAB1nKAAcjAr8XwzrEyiwSD43IgTzHOOZfMI3HmWQFeLXK3mzff+FBRzQMMus0Mb8rs5Pjbkzfg1YIAEhCKh0jlSFpGwSgYBaNgFGAAAPMMRiB/j4MkAAAAAElFTkSuQmCC","orcid":"","institution":"Purdue University in Indianapolis","correspondingAuthor":true,"prefix":"","firstName":"Mustafa","middleName":"","lastName":"Abdallah","suffix":""}],"badges":[],"createdAt":"2024-07-23 17:21:20","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-4790512/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-4790512/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":73379305,"identity":"4b5d9a45-1457-4442-9348-c097680d8a86","added_by":"auto","created_at":"2025-01-09 10:56:06","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":1110817,"visible":true,"origin":"","legend":"","description":"","filename":"EURASIPXAIWhitebox3.pdf","url":"https://assets-eu.researchsquare.com/files/rs-4790512/v1_covered_1b90062d-ac84-49cf-85c1-443503075b9b.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"A Comparative Analysis of DNN-based White-Box Explainable AI Methods in Network Security","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":true,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true},"keywords":"Explainable AI, XAI Evaluation, Intrusion Detection Systems, LRP, Integrated Gradients, Network Security, DeepLift, White-box AI, NSL-KDD, CICIDS-2017, RoEduNet-SIMARGL2021","lastPublishedDoi":"10.21203/rs.3.rs-4790512/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-4790512/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"New research focuses on creating artificial intelligence (AI) solutions for network intrusion detection systems (NIDS), drawing its inspiration from the ever-growing number of intrusions on networked systems, increasing its complexity and intelligibility. Hence, the use of explainable AI (XAI) techniques in real-world intrusion detection systems comes from the requirement to comprehend and elucidate black-box AI models to security analysts. In an effort to meet such requirements, this paper focuses on applying and evaluating White-Box XAI techniques (particularly LRP, IG, and DeepLift) for NIDS via an end-to-end framework for neural network models, using three widely used network intrusion datasets (NSL-KDD, CICIDS-2017, and RoEduNet-SIMARGL2021), assessing its global and local scopes, and examining six distinct assessment measures (descriptive accuracy, sparsity, stability, robustness, efficiency, and completeness). We also compare the performance of white-box XAI methods with black-box XAI methods. The results show that using White-box XAI techniques scores high in robustness and completeness, which are crucial metrics for IDS. Moreover, the source codes for the programs developed for our XAI evaluation framework are available to be improved and used by the research community.","manuscriptTitle":"A Comparative Analysis of DNN-based White-Box Explainable AI Methods in Network Security","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2024-08-21 05:41:13","doi":"10.21203/rs.3.rs-4790512/v1","editorialEvents":[{"type":"communityComments","content":0}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"052d89c7-50c9-4ad9-9b51-1c96b04f757d","owner":[],"postedDate":"August 21st, 2024","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"posted","subjectAreas":[],"tags":[],"updatedAt":"2025-01-15T04:38:08+00:00","versionOfRecord":[],"versionCreatedAt":"2024-08-21 05:41:13","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-4790512","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-4790512","identity":"rs-4790512","version":["v1"]},"buildId":"qtupq5eGEP_6zYnWcrvyt","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}