Training AI to improve detection of cyber threats

Network intrusion detection systems (NIDS) are essential for securing critical infrastructure, as cyberattacks often target industrial control system networks. AI techniques are increasingly used to detect malicious network traffic – but AI can also be exploited by attackers. To address this challenge, new techniques based on differentiable logics have been proposed to train AI models that are robust against adversarial AI attacks.

As part of an NFC project, we have developed a framework for training neural networks to satisfy logical constraints using  differentiable logics. This framework enabled a classifier that can detect malicious network traffic, that is robust against adversarial attacks and includes human domain knowledge. We aim to reduce alert fatigue by ruling out clearly benign network traffic while capturing typical attacks like DoS.

The classifier performance is consistent across different datasets, allowing NIDS to react to changes in the traffic distribution. In this workshop, we will demonstrate how differentiable logics enhance both prediction performance and explainability.