PANACEA: (exPlAinability-based eNsemble Adversarial training for Cyber-thrEAt detection)

The repository contains code refered to the work: A Neural Model Ensemble for Cyber-Threat Detection

Please cite it as: AL-Essa, M., Andresini, G., Appice, A. et al. PANACEA: a neural model ensemble for cyber-threat detection. Mach Learn (2024). https://doi.org/10.1007/s10994-023-06470-2

Code Requirements

• Python 3.9
• Keras 2.7
• Tensorflow 2.7
• Scikit learn
• Matplotlib 3.5
• Pandas 1.3.5
• Numpy 1.19.3
• Dalex 1.4.1
• adversarial-robustness-toolbox 1.9
• scikit-learn-extra 0.2.0
• Hyperopt 0.2.5

Description for this repository

• Datasets and Models.
  • Four different types of datasets are used in this work, NSL-KDD, UNSW-NB15, CICICD, and CIC-Maldroid20. The datasets are processed using one-hot encoder in order to change the categorical features to numerical features. MinMax scaler has been used to normalize the datasets. The datasets and models that have been used in work can be downloaded through Datasets and Models.

How to use

The implementation for all the experiments used in this work are listed in this repository.

• main.py : to run PANACEA

Replicate the Experiments

To replicate the experiments of this work, the models and datasets that have been saved in Datasets and Models can be used. Global Variable are saved in PANACEA.conf :

• TRAIN_BASELINE = 0   #1 train baseline with hyperopt
  

• CREATE_ADVERSARIAL_SET=0   #if 1 create the adversarial samples
  

• NUMBER_OF_MODELS=5   #Number of Models to be chosen
  

• sigma=0.05   #percentage of adversarial samples
  

• CREATE_CANDIDATE_MODELS = 0   #if 1 create the candidate models with the number of NUMBER_OF_MODELS
  

• USE_MEDOIDS=1   #if 0 the execution is performed with ensemble without medoids
  

• CREATE_DALEX_DATASET= 0   #if 1 create the csv with dalex values if 0 the csv file will be loaded
  

• ENSEMBLE = 1   #To choose the models based on the XAI and Clustering
  

• TRAIN_ENSEMBLE = 0   #1 To choose the ensemble members based on XAI and Clustering, and to train the ensemble model using hyperopt, #0 to compute the majority voting for the ensemble model
  

• INDIVIDUAL_PREDICTION=0   #0 no prediction, 1 prediction for individual models
  

• SEQUENTIAL = 0   #to choose the models sequentially
  

• USE_SEQUENTIAL = 0   #1 to train the ensemble model using hyperopt, 0 to compute the majority voting
  

• Majority_Voting = 0   #1 To choose Majority Voting for Predicting the Models
  

• Medoid_Voting = 0   #1 for choosing majority voting for medoids, 0 for choosing majority voting for sequential models