Overview:
Cyberattacks have become more frequent and complex, increasing the chance of malicious actors targeting infrastructure. Deep learning models have shown promise in being effective at detecting anomalies, but are generally uninterpretable. Our CIS framework seeks to incorporate Explainable AI (XAI) and knowledge graphs to make a more interpretable model that enhances the provided context of each detected anomaly, while balancing the predictive accuracy of deep learning models with the added XAI.
I began this project with data exploration and preprocessing. Since I had no prior experience with network or cybersecurity data, I conducted research to understand how the data was structured and behaved. During cleaning, I identified and fixed issues such as a misspelled feature and duplicate rows. I then developed multiple XGBoost models to benchmark against our graph neural network (GNN), including both regression and classification approaches. One model used only attack data, while another used a balanced attack vs. non-attack dataset that I synthesized. I tuned these models to achieve strong performance. I also built a framework for model explainability using SHAP. After learning how SHAP values work, I applied them to interpret model predictions and understand feature importance. This became my favorite part of the project, as it deepened my understanding of how models arrive at their predictions and how explainability is quantified! This project introduced me to cybersecurity and model interpretability while strengthening my ability to collaborate in a small team.
Skills used: Data Cleaning, Data Analysis, Knowledge graphs, Cybersecurity fundamentals, Explainable AI (XAI)
Tools used: Python, Neo4j, XGBoost, SHAP, Sklearn, Pandas, Numpy, Git, Github
Collaborators: Angelo State University, AI-COE