# Adversarial Robust and Explainable Network Intrusion Detection Systems Based on Deep Learning
## 5 Conclusions  
Creating adversarial, robust, and explainable DNN-based NIDS is a major step in ensuring a safe digital environment. The research work proposes a novel measure of adversarial robustness, Equation (12), for DNN adversarial robustness comparison. We also propose an adversarial robust and explainable network intrusion detection system based on deep neural networks by implementing explainable AI techniques and adversarial machine learning into NIDS. The overall results indicate that the adversarial-trained models are more robust to new adversarial samples and outperform the baseline MPL; this confirms the work of [2; 3; 19; 25; 39]. PGD adversarial-trained model was a more robust model than DeepFool- and FGSM-trained models. We implemented the SHAP technique to explain adversarial robust NIDS based on DL to extract important features used by the model to make classification decisions. We strongly believe that this is the first paper to implement a combination of explainable AI techniques and adversarial learning into IDS. Our adversarial robust and explainable NIDS based on deep learning was developed with a minimum number of adversarial attacks. Under the white-box scenario, we also used the NSL-KDD dataset because of its size and considerable number of attacks; however, it does not contain modern attacks. Hence, our current model suffers from generalizability. This predicament can be solved by retaining the model with modern network security datasets under a large pool of adversarial attacks. Future works should incorporate more novel network traffic datasets with more attacks to obtain a good measure of the impact of adversarial sample generation, thereby working toward a model that can be generalized.  
Conceptualization, K.S.; methodology, K.S.; software, K.S.; validation, G.-Y.S., D.-W.K. and M.-M.H.; formal analysis, K.S.; investigation, K.S.; resources, G.-Y.S. and M.-M.H.; data curation, K.S.; writing--original draft preparation, K.S.; writing--review and editing, K.S., G.-Y.S., D.-W.K. and M.-M.H.; visualization, K.S.; supervision, M.-M.H.; project administration, G.-Y.S. and M.-M.H.; funding acquisition, G.-Y.S., D.-W.K. and M.-M.H. All authors have read and agreed to the published version of the manuscript. This research was supported by National Research Foundation of Korea (NRF) grant funded by the Korea government (MSIT) (No. 2022R1F1A1073375).  
Not applicable.  
The data presented in this study are openly available in Canadian Institute for Cybersecurity. This dataset cabn be found here [[https://www.unb.ca/cic/datasets/nsl.html](https://www.unb.ca/cic/datasets/nsl.html)]([https://www.unb.ca/cic/datasets/nsl.html](https://www.unb.ca/cic/datasets/nsl.html)) (accessed on 28 April 2022).  
We would like to appreciate UCI Knowledge Discovery in Databases Archive ([[https://kdd.ics.uci.edu/](https://kdd.ics.uci.edu/)]([https://kdd.ics.uci.edu/](https://kdd.ics.uci.edu/))) for their efforts for providing clear explanation of KDD99 dataset.  
The authors declare no conflict of interest.  
Figure 17: DeepFool robustness test against PGD attacks (**a**). FGSM adversarial-trained model ROC-AUC (**b**).  
Figure 13: FGSM robustness test against DeepFool (**a**) and PGD attacks (**b**).  
Figure A4: PGD adversarial-trained model ROC-AUC (**a**). PGD robustness test against DeepFool attacks (**b**).  
Figure A5: PGD robustness test against FGSM attacks.