Recent advancements in Intrusion Detection Systems (IDS), integrating Explainable AI (XAI) methodologies, have led to notable improvements in system performance via precise feature selection. However, a thorough understanding of cyber-attacks requires inherently explainable decision-making processes within IDS. In this paper, we present the Interpretable Generalization Mechanism (IG), poised to revolutionize IDS capabilities. IG discerns coherent patterns, making it interpretable in distinguishing between normal and anomalous network traffic. Further, the synthesis of coherent patterns sheds light on intricate intrusion pathways, providing essential insights for cybersecurity forensics. By experiments with real-world datasets NSL-KDD, UNSW-NB15, and UKM-IDS20, IG is accurate even at a low ratio of training-to-test. With 10%-to-90%, IG achieves Precision (PRE)=0.93, Recall (REC)=0.94, and Area Under Curve (AUC)=0.94 in NSL-KDD; PRE=0.98, REC=0.99, and AUC=0.99 in UNSW-NB15; and PRE=0.98, REC=0.98, and AUC=0.99 in UKM-IDS20. Notably, in UNSW-NB15, IG achieves REC=1.0 and at least PRE=0.98 since 40%-to-60%; in UKM-IDS20, IG achieves REC=1.0 and at least PRE=0.88 since 20%-to-80%. Importantly, in UKM-IDS20, IG successfully identifies all three anomalous instances without prior exposure, demonstrating its generalization capabilities. These results and inferences are reproducible. In sum, IG showcases superior generalization by consistently performing well across diverse datasets and training-to-test ratios (from 10%-to-90% to 90%-to-10%), and excels in identifying novel anomalies without prior exposure. Its interpretability is enhanced by coherent evidence that accurately distinguishes both normal and anomalous activities, significantly improving detection accuracy and reducing false alarms, thereby strengthening IDS reliability and trustworthiness.

翻译：近期，融合可解释人工智能（XAI）方法的入侵检测系统（IDS）通过精准特征选择显著提升了系统性能。然而，要全面理解网络攻击，IDS需具备内在可解释的决策过程。本文提出可解释泛化机制（IG），该机制有望革新IDS的能力范畴。IG通过识别连贯模式，在区分正常与异常网络流量时具备可解释性。此外，连贯模式的整合揭示了复杂的入侵路径，为网络安全取证提供了关键洞察。基于真实数据集NSL-KDD、UNSW-NB15和UKM-IDS20的实验表明，即使在训练集与测试集比例极低的情况下，IG仍保持高精度。当训练-测试比例为10%:90%时，IG在NSL-KDD上精确率（PRE）达0.93、召回率（REC）达0.94、曲线下面积（AUC）达0.94；在UNSW-NB15上PRE达0.98、REC达0.99、AUC达0.99；在UKM-IDS20上PRE达0.98、REC达0.98、AUC达0.99。值得注意的是，在UNSW-NB15中，当训练-测试比例从40%:60%起，IG实现REC=1.0且PRE不低于0.98；在UKM-IDS20中，当比例从20%:80%起，IG实现REC=1.0且PRE不低于0.88。更关键的是，在UKM-IDS20数据集中，IG成功识别全部三种未见过的异常实例，展现了其泛化能力。上述结果与推论均可复现。综上，IG在不同数据集及训练-测试比例（从10%:90%到90%:10%）下均保持稳定表现，展现出卓越的泛化性能，并能准确识别未见过的新型异常。其通过连贯证据增强可解释性，精确区分正常与异常活动，显著提升检测精度并降低误报率，从而强化了IDS的可靠性与可信度。