Intrusion detection based on deep learning is inherently limited by the black-box nature of the models, which makes it difficult to ensure the trustworthiness of the results. Explainable Artificial Intelligence (XAI) techniques address this limitation by leveraging the powerful feature learning capabilities of black-box deep learning models and employing XAI methods to explore their decision boundaries, enabling the effective extraction of rules for intrusion detection. This approach provides a practical solution to the aforementioned challenges. In this paper, we propose an XAI-based automated rule extraction method for intrusion detection, designed to offer highly interpretable detection capabilities for encrypted traffic. The method begins by using CICFlowMeter to extract tabular traffic features and training a surrogate model to learn the representations of these features. Subsequently, an automated approach is developed to extract decision rules based on information from neural network layers, generating an initial rule set. This rule set is further refined through fine-tuning to optimize detection rules. We conducted experiments on two datasets using the generated detection rules. The experimental results demonstrate that the proposed method not only achieves excellent detection performance but also produces rules with high interpretability.

As the popularity of Advanced Persistent Threat (APT) grows, APT malware group classification has attracted more attention recently.However, most of previous methods use simple classifiers for group classification, ignoring the bias caused by the sparse number of revealed malware and the differences in functionality distribution of most groups.In this paper, we propose a Prediction-Guided Prototype Network (PGPNet) that could quickly adapt to new classification tasks with limited supervised samples based on the metalearning architecture.Adding malware functionality classification as an auxiliary task is beneficial for feature learning, and the bias of distribution differences is eliminated by intervening the predicted results into the group classifier.Experimental results on a APT malware dataset show that PGPNet successfully exploits the contextual information and predictions of the auxiliary task and achieves state-of-the-art performance.

The channel impulse response (CIR) of the wireless propagation channel is influenced by the surrounding environment and thus can be used to retrieve environmental information such as location, the presence of objects, and the speed of objects. In this work, we detect hand gestures based on the complex-valued CIR from an ultra-wideband (UWB) transmission link between one transmitter and two receivers. Thanks to the high path delay resolution due to the wide (500 MHz) bandwidth, we can focus on the channel that is influenced by hand gestures in the sensing area. Using different machine learning and deep learning methods, we learn the features from sequences of CIR snapshots that are correlated to hand gestures and recognize them.