MODEXRE Forensic Pipeline Uses SHAP Explainability for Intrusion Detection
Original title: Network Intrusion Forensic Detection System with Explainable Artificial Intelligence and Digital Chain of Custody
Extends XGBoost classifier with SHAP for explainable forensic intrusion detection with chain of custody.
Presents MODEXRE forensic pipeline using certified XGBoost model with SHAP explainability. Dual-mode: Laboratory and Formal. Normalizes Suricata alerts and logs. Addresses issues like timestamp leaks and feature gaps. After corrections, F1-macro 0.9538 on CICIDS2017-derived evidence.
- MODEXRE extends validated XGBoost with SHAP
- Dual-mode architecture with chain of custody
- Addresses timestamp leak and feature-coverage gap
- Default model F1-macro 0.9538; recertified 0.6214
From the original article
1 min read at arxiv.orgDeploying an explainable intrusion detection model from a validated laboratory setting into a forensic workflow requires guarantees that benchmarks do not test: that the certified model is the exact artifact applied to a case, that heterogeneous evidence can be classified reliably, and that every step is verifiable.
By Jose Luis Vela Alonso · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.