X-IDS Multimodel System
This repository contains trained models used in the X-IDS (Explainable Intrusion Detection System). The system combines anomaly detection, classification, and natural language generation to provide interpretable insights for intrusion detection.
Model Contents
| Model | Path | Description |
|---|
| Autoencoder | autoencoder-model/ | Detects anomalous traffic by reconstruction error |
| Binary Classifier | lgbm-binary-model.pkl | Classifies traffic as Normal or Attack |
| Multiclass Classifier | lgbm-multiclass-model.pkl | Predicts attack category (DoS, Exploit, etc) |
| Attack Explainer | t5-attack-explainer-v1/ | T5 model that generates explanations for attacks |
| Normal Explainer | t5-normal-explainer-v1/ | T5 model that generates explanations for normal traffic |
Usage Instructions
Autoencoder (Anomaly Detection)
1import torch
2import torch.nn.functional as F
3
4# Load your PyTorch autoencoder model
5model = torch.load("autoencoder-model/autoencoder.pt")
6model.eval()
7
8with torch.no_grad():
9 X_reconstructed = model(X_test_tensor)
10 errors = torch.mean((X_test_tensor - X_reconstructed) ** 2, dim=1).numpy()
11
12errors_normal = errors[y_test == 0]
13threshold = np.percentile(errors_normal, 95)
14
15y_pred = (errors > threshold).astype(int)
16
Binary Classifier (LightGBM)
1import pickle
2
3# Load the binary classifier
4with open("lgbm-binary-model.pkl", "rb") as f:
5 clf = pickle.load(f)
6
7# Make prediction
8pred = clf.predict(x_input)
9label = "Attack" if pred[0] == 1 else "Normal"
Multiclass Classifier (LightGBM)
1import pickle
2
3# Load the multiclass classifier
4with open("lgbm-multiclass-model.pkl", "rb") as f:
5 clf_multi = pickle.load(f)
6
7# Predict attack category
8pred_class = clf_multi.predict(x_input)[0]
T5 Text Generator – Attack
1from transformers import T5ForConditionalGeneration, T5Tokenizer
2
3# Load model
4model = T5ForConditionalGeneration.from_pretrained("t5-attack-explainer-v1")
5tokenizer = T5Tokenizer.from_pretrained("t5-attack-explainer-v1")
6
T5 Text Generator – Normal
1from transformers import T5ForConditionalGeneration, T5Tokenizer
2
3# Load model
4model = T5ForConditionalGeneration.from_pretrained("t5-normal-explainer-v1")
5tokenizer = T5Tokenizer.from_pretrained("t5-normal-explainer-v1")
Quick Start
- Clone this repository
- Download the model files
- Follow the usage instructions above for each model component
System Architecture
The X-IDS (Explainable Intrusion Detection System) is composed of four sequential modules that work together to detect, classify, and explain cybersecurity threats in network traffic:
1. Anomaly Detection (Autoencoder in PyTorch)
A deep autoencoder neural network is used as the first line of defense to detect anomalies in network behavior:
- Framework: Implemented using PyTorch
- Architecture: Fully connected symmetric encoder-decoder
- Input: Scaled numerical features from the UNSW-NB15 dataset
- Objective: Reconstruct normal traffic as accurately as possible
- Detection Rule: If the reconstruction error (e.g., MSE) exceeds a threshold, the traffic is flagged as anomalous
This unsupervised stage filters out obvious normal traffic and forwards only anomalous data to the next classification steps.
2. Binary Classification (LightGBM)
After anomaly detection, a binary LightGBM classifier is used to distinguish between normal and attack traffic:
- Input: Same scaled feature vectors as the autoencoder
- Target: Binary label (
0 = normal, 1 = attack)
- Why LightGBM: Efficient on tabular data, fast training, high accuracy
This module adds confidence to anomaly decisions and prepares input for attack categorization.
3. Attack Type Classification (Multiclass LightGBM)
If traffic is classified as an attack, it proceeds to a multiclass LightGBM classifier that predicts the type of attack:
- Target Classes: 9 attack types (e.g., Fuzzers, DoS, Reconnaissance, etc.)
- Input: Same feature space as previous stages
- Output: Attack category prediction used to guide explanation generation
This classifier enables fine-grained attack diagnosis, enhancing the usefulness of the final explanation.
4. Explanation Generation (Fine-Tuned T5-small)
To make the decision pipeline interpretable, two T5-small models (from Hugging Face Transformers) are fine-tuned to generate natural language explanations:
-
Model 1 (t5-xai-normal): Trained on normal traffic inputs with target_text = explanation
-
Model 2 (t5-xai-attack): Trained on attack inputs with rich, class-specific explanations
-
Input Format: Scaled features joined as text (e.g., "0.13:-0.21:1.01:...")
-
Output: Textual description (e.g., "This is a reconnaissance type of attack.")
-
Fine-tuning Details:
- Pretrained
t5-small model
- Trained using Hugging Face
Trainer
- Loss: Cross-entropy on token sequences
- Optimized for fluency and fidelity of explanation
These models turn numerical inputs into human-readable outputs, completing the transparency of the system.
Dataset
-
Description:
A benchmark IDS dataset that contains realistic modern network traffic with 9 categories of cyber attacks:
Fuzzers, Analysis, Backdoors, DoS, Exploits, Generic, Reconnaissance, Shellcode, and Worms.
-
Preprocessing:
- Numerical features were scaled using
StandardScaler
- Scaled feature vectors were joined into a single text sequence using
: as delimiter
Example: "0.45:-0.87:1.21:..."
- Label column (
attack_cat) was transformed into natural language explanations used as the generation target
- The resulting dataset is available on Hugging Face:
luminolous/xids-dataset
For more information about model, you can check it on my
GitHub Repository
License
This project is licensed under the MIT License.
