Zero-Day Attack Detection Using a Multi-Layer Perceptron with Explainable AI

Author

Dr. Arul Selvan Gnanamonickam A , Ravivishnu I

Abstract

 Zero-day network attacks exploit previously unseen behaviour patterns and routinely evade signature-based intrusion detection systems. This paper presents a prototype intrusion-detection system built on a Multi-Layer Perceptron (MLP) trained on the NSL-KDD benchmark dataset [1], supported by an Explainable AI (XAI) layer built with SHAP [3] and LIME [4], and delivered through a Flask web application. The system processes 41 standard network-traffic features, encodes categorical fields, applies standardized scaling, and classifies each record as normal traffic or one of several named attack categories. On the saved multiclass evaluation the MLP achieved 70.07% accuracy, 65.13% weighted precision, 70.07% weighted recall, and 65.97% weighted F1-score, with a binary ROC-AUC of 0.9251. On the saved binary normal-versus-attack evaluation the model achieved 86.75% accuracy, 90.51% precision, 85.72% recall, and 88.05% F1-score. A Random Forest baseline [6] was trained for comparison, reaching 72.18% accuracy but a lower weighted F1-score of 61.83%, illustrating that accuracy alone is an insufficient metric on imbalanced intrusion data. To support a genuine zero-day claim rather than an ordinary multiclass result, a held-out-label experiment was conducted: three attack types (satan, smurf, and guess_passwd) were individually removed from training and evaluated as unseen classes. Detection rates for these held-out attacks ranged from 2.27% to 58.91%, with combined binary accuracy between 86.67% and 95.78%, showing that generalisation to unseen attack families is partial and attack-type dependent rather than uniformly strong. SHAP and LIME visualisations are used to explain the global and local contribution of individual features to model predictions. The results indicate that MLP-based detectors can provide useful, interpretable intrusion-detection support, but that zero-day generalisation claims must be evaluated per-attack-family rather than assumed.

Keywords

Zero-day attack detection; Intrusion Detection System (IDS); Multi-Layer Perceptron; NSL-KDD; Explainable AI; SHAP; LIME; Random Forest.

Full Text:

Download Paper PDF

References

[1] Tavallaee, M., Bagheri, E., Lu, W., and Ghorbani, A. A. “A Detailed Analysis of the KDD CUP 99 Data Set.” Proceedings of the IEEE Symposium on Computational Intelligence for Security and Defense Applications, 2009.

[2] Abadi, M. et al. “TensorFlow: A System for Large-Scale Machine Learning.” Proceedings of the 12th USENIX Symposium on Operating Systems Design and Implementation (OSDI), 2016.

[3] Lundberg, S. M., and Lee, S.-I. “A Unified Approach to Interpreting Model Predictions.” Advances in Neural Information Processing Systems (NeurIPS), 2017.

[4] Ribeiro, M. T., Singh, S., and Guestrin, C. “‘Why Should I Trust You?’ Explaining the Predictions of Any Classifier.” Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2016.

[5] Pedregosa, F. et al. “Scikit-learn: Machine Learning in Python.” Journal of Machine Learning Research, 12, 2011.

[6] Breiman, L. “Random Forests.” Machine Learning, 45(1), 2001.

[7] Kim, J., Kim, J., Thu, H. L. T., and Kim, H. “Long Short Term Memory Recurrent Neural Network Classifier for Intrusion Detection.” International Conference on Platform Technology and Service (PlatCon), 2016.

[8] Vinayakumar, R., Soman, K. P., and Poornachandran, P. “Applying Convolutional Neural Network for Network Intrusion Detection.” International Conference on Advances in Computing, Communications and Informatics (ICACCI), 2017.

[9] Yin, C., Zhu, Y., Fei, J., and He, X. “A Deep Learning Approach for Intrusion Detection Using Recurrent Neural Networks.” IEEE Access, vol. 5, 2017.

[10] Javaid, A., Niyaz, Q., Sun, W., and Alam, M. “A Deep Learning Approach for Network Intrusion Detection System.” Proceedings of the 9th EAI International Conference on Bio-inspired Information and Communications Technologies (BICT), 2016.

[11] Shone, N., Ngoc, T. N., Phai, V. D., and Shi, Q. “A Deep Learning Approach to Network Intrusion Detection.” IEEE Transactions on Emerging Topics in Computational Intelligence, vol. 2, no. 1, 2018.

[12] Moustafa, N., and Slay, J. “UNSW-NB15: A Comprehensive Data Set for Network Intrusion Detection Systems.” Military Communications and Information Systems Conference (MilCIS), 2015.

[13] Sharafaldin, I., Lashkari, A. H., and Ghorbani, A. A. “Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization.” International Conference on Information Systems Security and Privacy (ICISSP), 2018.

[14] Ioffe, S., and Szegedy, C. “Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift.” Proceedings of the 32nd International Conference on Machine Learning (ICML), 2015.

[15] Srivastava, N., Hinton, G., Krizhevsky, A., Sutskever, I., and Salakhutdinov, R. “Dropout: A Simple Way to Prevent Neural Networks from Overfitting.” Journal of Machine Learning Research, vol. 15, 2014.

[16] Kingma, D. P., and Ba, J. “Adam: A Method for Stochastic Optimization.” International Conference on Learning Representations (ICLR), 2015.

[17] Chawla, N. V., Bowyer, K. W., Hall, L. O., and Kegelmeyer, W. P. “SMOTE: Synthetic Minority Over-sampling Technique.” Journal of Artificial Intelligence Research, vol. 16, 2002.

[18] Sommer, R., and Paxson, V. “Outside the Closed World: On Using Machine Learning for Network Intrusion Detection.” IEEE Symposium on Security and Privacy, 2010.

[19] Buczak, A. L., and Guven, E. “A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection.” IEEE Communications Surveys & Tutorials, vol. 18, no. 2, 2016.

[20] Ahmad, Z., Shahid Khan, A., Wai Shiang, C., Abdullah, J., and Ahmad, F. “Network Intrusion Detection System: A Systematic Study of Machine Learning and Deep Learning Approaches.” Transactions on Emerging Telecommunications Technologies, vol. 32, no. 1, 2021.

[21] Hodo, E., Bellekens, X., Hamilton, A., Dubouilh, P.-L., Iorkyase, E., Tachtatzis, C., and Atkinson, R. “Threat Analysis of IoT Networks Using Artificial Neural Network Intrusion Detection System.” International Symposium on Networks, Computers and Communications (ISNCC), 2016.

[22] Pallets Projects. Flask Documentation. https://flask.palletsprojects.com/

 

 

Share your valuable work from Social Media Buttons