Analysis of Zero Day Attack Detection Using MLP and XAI

2025-01-28

AI Summary

Addressing the challenges of low detectability and poor interpretability in zero-day network attack detection, this paper proposes an intrusion detection system (IDS) based on a weighted truncated multilayer perceptron (MLP) integrated with eXplainable Artificial Intelligence (XAI). Leveraging the KDD99 dataset, we formulate a multi-class IDS and introduce a novel weighted truncated MLP architecture that achieves a high overall accuracy of 99.62% while substantially improving recall for minority attack classes. To our knowledge, this is the first work to apply SHAP (SHapley Additive exPlanations) for feature attribution analysis in zero-day detection MLPs, enabling quantitative identification of critical layer-wise feature contributions and empirically validating model robustness and decision transparency. The proposed approach jointly optimizes detection performance, class-balanced metrics, and model interpretability, establishing a new paradigm for zero-day attack identification that ensures both high precision and trustworthy, auditable decisions.

Technology Category

• Machine Learning: Transparent, Interpretable, Explainable ML
• Humans and AI: Explainable AI (XAI) for Human Understanding
• Natural Language Processing: Interpretability, Analysis, and Evaluation of NLP Models

Application Category

• Web Mining and Content Analysis: Large pretrained models with web data
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications

Abstract

Any exploit taking advantage of zero-day is called a zero-day attack. Previous research and social media trends show a massive demand for research in zero-day attack detection. This paper analyzes Machine Learning (ML) and Deep Learning (DL) based approaches to create Intrusion Detection Systems (IDS) and scrutinizing them using Explainable AI (XAI) by training an explainer based on randomly sampled data from the testing set. The focus is on using the KDD99 dataset, which has the most research done among all the datasets for detecting zero-day attacks. The paper aims to synthesize the dataset to have fewer classes for multi-class classification, test ML and DL approaches on pattern recognition, establish the robustness and dependability of the model, and establish the interpretability and scalability of the model. We evaluated the performance of four multilayer perceptron (MLP) trained on the KDD99 dataset, including baseline ML models, weighted ML models, truncated ML models, and weighted truncated ML models. Our results demonstrate that the truncated ML model achieves the highest accuracy (99.62%), precision, and recall, while weighted truncated ML model shows lower accuracy (97.26%) but better class representation (less bias) among all the classes with improved unweighted recall score. We also used Shapely Additive exPlanations (SHAP) to train explainer for our truncated models to check for feature importance among the two weighted and unweighted models.

Problem

• Machine Learning
• Deep Learning
• Zero-day Attack Detection

Innovation

• Explainable AI (XAI)
• Intrusion Detection System (IDS) Optimization
• Shapely Additive exPlanations (SHAP)