A Network Intrusion Detection System (NIDS) monitors networks for cyber attacks and other unwanted activities. However, NIDS solutions often generate an overwhelming number of alerts daily, making it challenging for analysts to prioritize high-priority threats. While deep learning models promise to automate the prioritization of NIDS alerts, the lack of transparency in these models can undermine trust in their decision-making. This study highlights the critical need for explainable artificial intelligence (XAI) in NIDS alert classification to improve trust and interpretability. We employed a real-world NIDS alert dataset from Security Operations Center (SOC) of TalTech (Tallinn University Of Technology) in Estonia, developing a Long Short-Term Memory (LSTM) model to prioritize alerts. To explain the LSTM model's alert prioritization decisions, we implemented and compared four XAI methods: Local Interpretable Model-Agnostic Explanations (LIME), SHapley Additive exPlanations (SHAP), Integrated Gradients, and DeepLIFT. The quality of these XAI methods was assessed using a comprehensive framework that evaluated faithfulness, complexity, robustness, and reliability. Our results demonstrate that DeepLIFT consistently outperformed the other XAI methods, providing explanations with high faithfulness, low complexity, robust performance, and strong reliability. In collaboration with SOC analysts, we identified key features essential for effective alert classification. The strong alignment between these analyst-identified features and those obtained by the XAI methods validates their effectiveness and enhances the practical applicability of our approach.

The digitalisation of the world is a global trend affecting many industries, including the maritime transport sector. Electronic navigational equipment aboard modern ships has undoubtedly decreased naval accidents, but these devices may suffer from cybersecurity vulnerabilities. One such vector, is its reliance on a great number of protocols for communication. Currently there is limited awareness of the security strengths and weaknesses of maritime protocols, because of the manual-reverse-engineering cost due to their proprietary nature. However, we substantiate that advances in automated protocol reverse-engineering are effectively lowering this cost. Our paper analyses a proprietary protocol, widely used in naval equipment. This protocol was reverse engineered through manual and automated techniques, revealing the advantages and drawbacks of both. Our results show that statistical automated protocol reverse-engineering techniques were sufficient to discover the relevant protocol fields. We introduce the disclosed communication structure and its vulnerabilities, which are both verified by the success of rudimentary attacks. The disclosed protocol, by manual and automated techniques, could also aid intrusion detection (and prevention) system development for maritime operational technology systems, to help vendors avoid the identified vulnerabilities during system design and implementation.

System logs provide valuable information about the health status of IT systems and computer networks. Therefore, log file monitoring has been identified as an important system and network management technique. While many solutions have been developed for monitoring known log messages, the detection of previously unknown error conditions has remained a difficult problem. In this paper, we present a novel data mining based framework for detecting anomalous log messages from syslog- based system log files. We also describe the implementation and performance of the framework in a large organizational network.

Modern IT systems often produce large volumes of event logs, and event pattern discovery is an important log management task. For this purpose, data mining methods have been suggested in many previous works. In this paper, we present the LogCluster algorithm which implements data clustering and line pattern mining for textual event logs. The paper also describes an open source implementation of LogCluster.

Network IDS is a well-known security measure for network monitoring and protection. Unfortunately, IDSs are known to generate large amounts of alerts, with many of them being either false positives or of low importance. This makes it hard for the human to spot alerts which need more attention. In order to tackle this issue, this paper proposes an IDS alert classification method which is based on data mining techniques.

With the growth of communication networks, event logs are increasing in size at a fast rate. Today, it is not uncommon to have systems that generate tens of gigabytes of log data per day. Log data are likely to contain information that deserves closer attention - such as security events - but the task of reviewing logs manually is beyond the capabilities of a human. This paper discusses data mining tools SLCT and log hound that were designed for assisting system management personnel in extracting knowledge from event logs.

Event correlation plays an important role in today's network management, reducing large amounts of network events to smaller and more meaningful sets of alarms. Most of the commercially available event correlation tools have a design that is over-complicated for majority of small and medium range applications, all of them are platform dependent, and last but not least, they are expensive for academic use. This paper presents a lightweight open source network management tool called sec designed to implement platform independent event correlation.