Mississippi State University
Date of Degree
Graduate Thesis - Open Access
Master of Science (M.S.)
James Worth Bagley College of Engineering
Department of Computer Science and Engineering
Intrusion Detection Systems (IDS) that provide high detection rates but are black boxes lead
to models that make predictions a security analyst cannot understand. Self-Organizing Maps
(SOMs) have been used to predict intrusion to a network, while also explaining predictions through
visualization and identifying significant features. However, they have not been able to compete with
the detection rates of black box models. Growing Hierarchical Self-Organizing Maps (GHSOMs)
have been used to obtain high detection rates on the NSL-KDD and CIC-IDS-2017 network traffic
datasets, but they neglect creating explanations or visualizations, which results in another black
This paper offers a high accuracy, Explainable Artificial Intelligence (XAI) based on GHSOMs.
One obstacle to creating a white box hierarchical model is the model growing too large and complex
to understand. Another contribution this paper makes is a pruning method used to cut down on
the size of the GHSOM, which provides a model that can provide insights and explanation while
maintaining a high detection rate.
Kirby, Thomas Michael, "Pruning GHSOM to create an explainable intrusion detection system" (2023). Theses and Dissertations. 5791.