An explainable Recursive Feature Elimination to detect Advanced Persistent Threats using Random Forest classifier
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2025
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866909899691130880 |
|---|---|
| author | Mutalib, Noor Hazlina Abdul Sabri, Aznul Qalid Md Wahab, Ainuddin Wahid Abdul Abdullah, Erma Rahayu Mohd Faizal AlDahoul, Nouar |
| author_facet | Mutalib, Noor Hazlina Abdul Sabri, Aznul Qalid Md Wahab, Ainuddin Wahid Abdul Abdullah, Erma Rahayu Mohd Faizal AlDahoul, Nouar |
| contents | Intrusion Detection Systems (IDS) play a vital role in modern cybersecurity frameworks by providing a primary defense mechanism against sophisticated threat actors. In this paper, we propose an explainable intrusion detection framework that integrates Recursive Feature Elimination (RFE) with Random Forest (RF) to enhance detection of Advanced Persistent Threats (APTs). By using CICIDS2017 dataset, the approach begins with comprehensive data preprocessing and narrows down the most significant features via RFE. A Random Forest (RF) model was trained on the refined feature set, with SHapley Additive exPlanations (SHAP) used to interpret the contribution of each selected feature. Our experiment demonstrates that the explainable RF-RFE achieved a detection accuracy of 99.9%, reducing false positive and computational cost in comparison to traditional classifiers. The findings underscore the effectiveness of integrating explainable AI and feature selection to develop a robust, transparent, and deployable IDS solution. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2511_09603 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | An explainable Recursive Feature Elimination to detect Advanced Persistent Threats using Random Forest classifier Mutalib, Noor Hazlina Abdul Sabri, Aznul Qalid Md Wahab, Ainuddin Wahid Abdul Abdullah, Erma Rahayu Mohd Faizal AlDahoul, Nouar Cryptography and Security Artificial Intelligence Intrusion Detection Systems (IDS) play a vital role in modern cybersecurity frameworks by providing a primary defense mechanism against sophisticated threat actors. In this paper, we propose an explainable intrusion detection framework that integrates Recursive Feature Elimination (RFE) with Random Forest (RF) to enhance detection of Advanced Persistent Threats (APTs). By using CICIDS2017 dataset, the approach begins with comprehensive data preprocessing and narrows down the most significant features via RFE. A Random Forest (RF) model was trained on the refined feature set, with SHapley Additive exPlanations (SHAP) used to interpret the contribution of each selected feature. Our experiment demonstrates that the explainable RF-RFE achieved a detection accuracy of 99.9%, reducing false positive and computational cost in comparison to traditional classifiers. The findings underscore the effectiveness of integrating explainable AI and feature selection to develop a robust, transparent, and deployable IDS solution. |
| title | An explainable Recursive Feature Elimination to detect Advanced Persistent Threats using Random Forest classifier |
| topic | Cryptography and Security Artificial Intelligence |
| url | https://arxiv.org/abs/2511.09603 |