Investigating Cognitive Salience and SHAPley Values for Model Explainability in Intrusion Detection Datasets

Abstract

We compare a cognitive salience algorithm with SHAPley values to show how cognitive salience provides an alternate measure of the extent to which each feature is responsible for making a particular decision in a given context. We show how local cognitive salience is computed in near real-time. By being embedded in cognitive mechanisms, cognitive salience is influenced by recency, frequency, and order effects appropriate to interpreting both cognitive model and arbitrary machine learning output. Applying this technique to intrusion detection datasets (UNSW-NB15, CICIDS2017, NSL-KDD), we compute the salience of each feature for any given classification. By tracing (i.e., clamping) our model’s decisions to that of a specific classification technique or individual decision maker, we are able to provide measures of model-agnostic salience. We then compare our output to SHAP values, which are a comparable game-theoretic measure of local and global feature importance. We show how our salience is more scalable than Tree-based SHAP techniques and discuss when predictions vary.