E-GNNExplainer: Single-Instance Explanation of Edge-Classification Graph Neural Networks-based Network Intrusion Detection Systems

Abstract

Abstract : The ever-increasing evolution of deep learning methods has made it possible to apply them in all fields, more specifically in the field of cybersecurity. With the exponential growth of the volume of data circulating in the global network, network security becomes a paramount necessity, by applying different security mechanisms such as Network Intrusion Detection Systems. The intersection between deep learning and network intrusion detection systems has achieved much success, in particular, by considering the topological data structure of the networks to secure them by applying Graph Neural Networks, an emerging sub-field of deep learning, based on the study of the graph structure. Recently, explaining artificial intelligence methods has become an important task, especially when working on a sensitive area such as cybersecurity, however, there is a lack of study for the explainability on Graph Neural Networks. In this master thesis, we introduced the main aspects of network intrusion detection systems, and the graph neural networks approach. Then we introduced the notions of explainable artificial intelligence and presented the state of the art of explainability methods employed to explain graph neural networks