Explainable Classification of Network Traffic for Intrusion Detection with Neural Networks

Abstract

# Project Overview This project aims to provide a Network Intrusion Detection System (NIDS) on a local network to passively investigate network traffic for anomalies and potentially malicious activity.
public 9 months ago 4 months ago BSc
Engagements
SupervisorSecond ReaderAuthorAssigned to
Krishnendu Guha Md Noor-A-Rahim Feilim White Feilim White

Description https://project.cs.ucc.ie/project/1547

Network Intrusion Detection Systems (NIDS) play an important role in modern cybersecurity by monitoring network traffic for malicious activity, policy violations, and anomalous behaviour that may indicate an attack. They are useful in practice because they provide an additional layer of defence, help security teams identify threats earlier, and support the protection of large and complex networked environments. However, traditional intrusion detection systems often produce high numbers of false positives, which can overwhelm analysts and reduce the practical usefulness of alerts. Recent advances in Deep Learning have improved the ability of NIDS to identify complex patterns in network traffic, but these models are often difficult to interpret and can therefore be challenging to trust in operational settings. This project will research the effectiveness of integrating a Deep Neural Network (DNN) into Stratosphere Linux IPS, a modular network intrusion prevention system. To combat the ‘Black-Box’ nature of the neural network the SHAP framework will be applied to introduce explainability and transparency to the models predictions. By combining detection, explanation, and visual analysis in a single system, the project aims to demonstrate how deep learning can be applied more effectively and more transparently within a practical NIDS environment to reduce false positives and alert fatigue in analysts