Pith. sign in

REVIEW 6 major objections 7 minor 1 cited by

Tabular Diffusion based Actionable Counterfactual Explanations for Network Intrusion Detection

T0 review · 6 major / 7 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that a classifier-guided tabular diffusion model, distilled to a tenth of its sampling steps, provides minimal, diverse counterfactual explanations for network intrusion queries faster than the tested alternatives, and…

desk verdict A useful first comparative benchmark of counterfactual methods for NIDS, with a credible diffusion-based method, but the abstract's claim that the extracted rules can 'effectively filter' attacks is explicitly untested and should be cut or substantiated. read the letter →

arxiv 2507.17161 v1 pith:QQLVB66R submitted 2025-07-23 cs.LG cs.AI

Vinura Galwaduge , Jagath Samarabandu This is my paper
classification cs.LGcs.AI
keywords counterfactualexplanationsdiffusionmodelsnetworkintrusiondetectionexplainableAItabulardataprogressivedistillationglobalrulesactionable
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper is trying to establish that diffusion-based counterfactual generation is a practical fit for network intrusion detection, where explanations must be fast, valid, sparse, and diverse enough to support defense actions. It proposes a guided diffusion model that treats numerical and categorical features with separate noise processes and uses classifier gradients to steer generated samples toward the benign class. Progressive distillation cuts the number of diffusion steps from 2500 to 250, and the paper reports that this distilled version produces valid, plausible explanations with lower sparsity and time cost than the evaluated baselines across three intrusion datasets. It further claims that fitting decision trees to the generated counterfactuals yields global rules that separate attack queries from benign traffic, giving analysts actionable filters rather than just feature rankings.

What carries the argument

The central object is a classifier-guided denoising diffusion probabilistic model for tabular data, with separate forward diffusion processes for numerical features, which receive Gaussian noise, and categorical features, which receive categorical noise. During sampling, a gradient of a counterfactual loss, binary cross-entropy toward the target class plus an L1 distance to the original query, is applied to the intermediate noisy samples, steering the reverse process into the benign region. Progressive distillation then compresses the 2500-step sampler into 250 steps, which is what makes the explanation time competitive. The rule-extraction step fits an unrestricted decision tree to the generated counterfactuals and their original attack queries and reads off high-purity benign leaves as global rules.

What would settle it

Take the three datasets, fix one black-box classifier with identical weights for every counterfactual method, generate explanations for the same 1000-query attack pool with the same random seeds, and compare measured 1-validity, sparsity, log-LOF, and wall-clock generation time. If TabDiff-distill no longer beats the baselines on sparsity and time under these controls, the paper's central efficiency claim fails.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that the same denoising machinery that generates tabular data can be steered by the classifier's own gradient to produce counterfactuals that flip attack predictions to benign while preserving plausibility by staying near the data manifold. The proposed TabDiff and TabDiff-distill handle heterogeneous features directly, using Gaussian noise for numerical features and categorical noise for categorical features, instead of forcing everything through a shared continuous embedding, and the distilled variant achieves a tenfold reduction in sampling steps with improved sparsity. In the reported experiments, TabDiff-distill yields high validity and low anomaly scores on UNSW-NB15, CIC-DDoS-2019, and CIC-IDS-2017, and it is the fastest generative method after VCNet, which does not provide diverse explanations. The paper also reports that decision-tree rules fitted to the diverse counterfactuals are attack-specific and differ from rules fitted to training data, suggesting the counterfactual route reveals protocol-relevant filters.

Load-bearing premise

The comparison assumes that the separately trained classifiers used by each counterfactual method are similar enough that differences in explanation quality come from the explanation method, not from the decision boundary.

Editorial extensions

If this is right

  • A security analyst could receive, for each flagged attack, a small set of concrete feature-value edits that would make the system classify the traffic as benign, instead of a ranked list of features.
  • The tenfold reduction in diffusion steps makes counterfactual generation fast enough to consider for interactive alert triage, at least on the three tested datasets.
  • The global rules give security teams candidate drop rules for unseen attack variants, derived without exposing the training data.
  • The comparison provides a baseline map showing which recourse-oriented counterfactual algorithms transfer poorly to network data, so future work can focus on generative approaches.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper stops short of testing the rules as live filters; replaying held-out attack traffic against the derived drop rules and measuring false positives and false negatives would directly test the filtering claim.
  • Because the method generates multiple diverse counterfactuals per query, deliberately selecting a diverse subset before tree fitting could make the global rules cover more attack variants than the current default decision-tree procedure.
  • The distillation trade-off, fewer steps and better sparsity at the cost of a slightly higher anomaly score, suggests the step count can be tuned as a deployment knob depending on how much plausibility an operator is willing to sacrifice for speed.
  • The same guided diffusion recipe could be applied to multi-class intrusion labels, producing per-attack-type rules rather than a single benign-versus-attack split.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

6 major / 7 minor

Summary. The paper proposes TabDiff, a diffusion-based counterfactual explanation method for tabular network intrusion detection data, together with a distilled variant TabDiff-distill that reduces the number of diffusion steps. The method treats numerical and categorical features with separate diffusion processes and uses classifier guidance to generate minimal, diverse, and plausible counterfactuals. The authors evaluate TabDiff and TabDiff-distill against Wachter, DiCE, FACE, VCNet, CCHV AE, and SCD on UNSW-NB15, CIC-DDoS-2019, and CIC-IDS-2017, reporting sparsity, validity, plausibility (log-LOF), and generation time. They also propose extracting global rules from the generated counterfactuals via decision trees and claim these rules can effectively filter incoming attack queries. The abstract further claims that the proposed method is more efficient than the tested counterfactual explanation algorithms and that the work provides the first comparative analysis of counterfactual methods in the NIDS context.

Significance. If the central claims were fully supported, the paper would make a useful contribution: it provides one of the first systematic comparisons of counterfactual explanation methods for NIDS, introduces a diffusion-based approach tailored to heterogeneous tabular data, and offers a concrete mechanism for turning counterfactuals into global, potentially actionable rules. The use of progressive distillation to reduce generation time is a practical idea, and the explicit attention to diversity as a resource for rule extraction is sensible. However, several load-bearing points currently undermine the claims: the core equations are not correctly stated, the comparative evaluation uses different classifier decision boundaries across methods, the efficiency claim is contradicted by the reported VCNet times, and the filtering capability claimed in the abstract is explicitly not evaluated. These issues are fixable within the manuscript's scope, but they need substantive revision before the claims can be accepted.

major comments (6)
  1. [Section 2.2.2, Eq. (4)] The binary cross-entropy term in Eq. (4) is miswritten: it should be "(1 - y_CF) log(1 - f(x_t))" rather than "(1 - y_CF)(1 - log(f(x_t)))". As written, the loss is not a binary cross-entropy and the gradient used for guidance in Eq. (5) would be incorrect. Because this loss is the mechanism that steers counterfactual generation, the equation must be corrected and the implementation must be checked against the corrected form.
  2. [Section 2.2.2, Eqs. (2), (3), and (5)] The forward diffusion equations are not well-formed: Eq. (2) defines x_t,num as a pair of quantities rather than a single noisy sample, and the product notation "α = Qt i=1 βi" is ambiguous and uses α where the overline is needed (standard DDPM defines \bar{α}_t = \prod_{i=1}^t (1 - β_i)). Eq. (3) uses "\bar{α}_0,cati", which is undefined, and the categorical distribution C(·) is not specified precisely. Eq. (5) also has unclear indexing (x_CF,t+1 ← x_t+1 − α∇...). These notational issues make the method difficult to reproduce and should be rewritten in standard diffusion notation.
  3. [Section 3.2 and Tables 2, 3, and 4] The comparative evaluation is confounded by different classifier decision boundaries across methods. The text states that the same black-box architecture was used, but the Acc/F1 columns differ substantially within each dataset (e.g., UNSW-NB15: DiCE 89.10/90.44 vs. SCD/TabDiff 87.65/89.02; CIC-IDS-2017: Wachter 99.46/98.56 vs. VCNet 98.44/95.8). If separate classifiers were trained for each method, explanation quality reflects not only the counterfactual method but also the particular decision boundary; if a shared classifier was used, the reason for the different Acc/F1 values must be explained. The paper should rerun the comparison using a single trained classifier per dataset for all methods (except where a method requires joint training, which should be justified) and report statistical significance across the random runs.
  4. [Abstract and Section 5] The abstract claims that the derived global counterfactual rules "show the ability to effectively filter out incoming attack queries," but Section 5 explicitly states, "we do not evaluate the efficacy of the filtering capability of the rules as it is out of scope of this work." No detection rate, false-positive rate, precision, recall, or comparison to a trivial filter is provided. This unsupported claim is central to the paper's actionability message and must either be removed or substantiated with a concrete filtering experiment.
  5. [Section 4 and Tables 2, 3, and 4] The abstract's efficiency claim that the proposed method is "more efficient" than the tested counterfactual explanation algorithms is contradicted by the reported times: VCNet has time values around 4e-6 seconds across all three datasets, while TabDiff-distill has 0.92, 1.65, and 0.54 seconds, respectively. The text itself identifies VCNet as having the best efficiency. The claim should be restricted to the diffusion-based and non-VCNet baselines, or the comparison should be revisited, since "out of the tested counterfactual explanation algorithms" is inaccurate as written.
  6. [Section 3.2 and Appendix B] VCNet and SCD are self-implemented because no public implementations were available, but no validation is provided that these implementations faithfully reproduce the original methods. The ranking of TabDiff against these baselines depends directly on the fidelity of these reimplementations. The authors should provide the code, detailed hyperparameters, and a sanity check (for example, reproducing a metric reported in the original VCNet and SCD papers, or benchmarking on a standard tabular recourse dataset).
minor comments (7)
  1. [Abstract] There are grammatical errors: "Our proposed method provide" should be "Our proposed method provides," and the phrase "These rules are actionable not only at instance level but also at the global level" is redundant.
  2. [Section 1] The phrase "image image" contains a duplicated word and should be corrected.
  3. [Section 2.1] "However, This would not be scalable" has incorrect capitalization and should read "However, this approach would not be scalable".
  4. [Section 4] The sentence "Table 6 show a few samples" should be "Table 6 shows a few samples."
  5. [Section 4.1] The attacks were "picked based on the performance of the classifier model," which introduces selection bias; this should be stated as a limitation and, ideally, supplemented with results on additional attacks to show that rule extraction is not only demonstrated on favorable cases.
  6. [Appendix B.2 and Algorithm 1] The decision tree is created with default parameters and no depth restriction, and the purity threshold of >0.9 is not justified; the sensitivity of the extracted rules to these choices should be reported or at least discussed.
  7. [Section 4, Figure 2] The preferred regions marked with dashed red rectangles should be made clearly visible in the printed version, since several subplots appear to have overlapping points near those regions.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity; the central claims rest on empirical comparisons against external baselines, with only a minor non-load-bearing self-citation.

full rationale

The paper's derivation chain is not circular. TabDiff and TabDiff-distill are generative counterfactual explanation methods trained on the three public datasets and compared against external baseline implementations from CARLA (Wachter, DiCE, FACE, CCHVAE) plus the authors' own VCNet and SCD implementations. The reported speed, sparsity, validity, and plausibility values are measured on held-out attack pools and are not obtained by fitting the evaluation metrics themselves. The global counterfactual rules are extracted with a decision tree from generated counterfactual explanations, and the accompanying SHAP plots are computed from the same counterfactuals; the paper presents this as consistency, not as an independent validation, so no prediction reduces to its own input. The one self-citation (Ref. [1], an earlier survey by the same authors) is used only to motivate deep-learning-based NIDS and is not load-bearing for the proposed method or its evaluation. Section 5 explicitly states that the filtering capability of the rules was not evaluated ('However, we do not evaluate the efficacy of the filtering capability of the rules as it is out of scope of this work'), which makes the abstract's 'effectively filter' wording an unsupported claim, but that is a correctness/overclaim issue rather than circularity. The minor non-load-bearing self-citation warrants a score of 2 rather than 0, but no circular step rises to the level of a fitted input being renamed as a prediction or an imported self-citation chain.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The paper introduces no new physical or conceptual entities. Its free parameters are standard hyperparameters, but several are unreported or chosen without sensitivity analysis. The key domain assumption is that decision-tree rules over generated counterfactuals will filter real attacks, which remains untested.

free parameters (4)
  • Diffusion steps T and distilled steps = 2500 down to 250
    Hand-chosen; distillation reduces steps tenfold to balance time and plausibility (Section 2.2.2).
  • Guidance scale alpha in Eq. 5 = Not reported (arbitrary alpha in R)
    Selected arbitrarily as per Section 2.2.2, yet it controls the strength of counterfactual guidance.
  • Decision-tree purity threshold for rule extraction = 0.9
    Algorithm 1 keeps nodes with purity greater than 0.9 for benign data, chosen without reported sensitivity analysis (Appendix B.2).
  • L1 distance weight in counterfactual loss = Implicit unweighted sum
    The loss adds BCE and L1 distance without an explicit trade-off weight, an unstated modeling choice in Eq. 4.
assumptions (4)
  • standard math Standard DDPM/diffusion theory (Ho et al. 2020, Salimans and Ho 2022) is a reliable generative model for tabular data.
    Adopted without proof in Section 2.2.2.
  • domain assumption The binary classifier's decision boundary is a sufficient target for counterfactual explanations; class probabilities are meaningful for guidance.
    The counterfactual loss uses the classifier's probabilistic output (Eq. 4).
  • domain assumption Global rules derived from generated counterfactuals can generalize to filter unseen attack traffic.
    Stated as useful in Section 4.1 and the Abstract, but not evaluated; the paper admits filtering efficacy is out of scope (Section 5).
  • domain assumption The three public datasets (UNSW-NB15, CIC-DDoS-2019, CIC-IDS-2017) adequately represent network intrusion detection settings.
    Used as evaluation domain in Section 3.1.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Tabular Diffusion based Actionable Counterfactual Explanations for Network Intrusion Detection." pith.science (2026). https://pith.science/paper/QQLVB66R

@misc{pith2026250717161,
  author       = {Pith},
  title        = {Pith review of: Tabular Diffusion based Actionable Counterfactual Explanations for Network Intrusion Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QQLVB66R}},
  note         = {Machine review of arXiv:2507.17161}
}
read the original abstract

Modern network intrusion detection systems (NIDS) frequently utilize the predictive power of complex deep learning models. However, the "black-box" nature of such deep learning methods adds a layer of opaqueness that hinders the proper understanding of detection decisions, trust in the decisions and prevent timely countermeasures against such attacks. Explainable AI (XAI) methods provide a solution to this problem by providing insights into the causes of the predictions. The majority of the existing XAI methods provide explanations which are not convenient to convert into actionable countermeasures. In this work, we propose a novel diffusion-based counterfactual explanation framework that can provide actionable explanations for network intrusion attacks. We evaluated our proposed algorithm against several other publicly available counterfactual explanation algorithms on 3 modern network intrusion datasets. To the best of our knowledge, this work also presents the first comparative analysis of existing counterfactual explanation algorithms within the context of network intrusion detection systems. Our proposed method provide minimal, diverse counterfactual explanations out of the tested counterfactual explanation algorithms in a more efficient manner by reducing the time to generate explanations. We also demonstrate how counterfactual explanations can provide actionable explanations by summarizing them to create a set of global rules. These rules are actionable not only at instance level but also at the global level for intrusion attacks. These global counterfactual rules show the ability to effectively filter out incoming attack queries which is crucial for efficient intrusion detection and defense mechanisms.

Figures

Figures reproduced from arXiv: 2507.17161 by the authors.

Figure 1
Figure 1. Comparison of the evaluated metrics of the counterfactual explanations with increasing attack pool sizes. Each [PITH_FULL_IMAGE:figures/full_fig_p008_1.png] view at source ↗
Figure 2
Figure 2. Scatter plots representing the behavior of sparsity (a), validity (b) and log-LOF(c) against time (from [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗
Figure 3
Figure 3. SHAP feature importance plot obtained using generated (a) - counterfactual explanations, and (b) - using [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: SHAP feature importance plot obtained (a) - using generated counterfactuals, and (b) - using training data for [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Neuro-Symbolic AI for Cybersecurity: State of the Art, Challenges, and Opportunities

    cs.CR 2025-09 unverdicted novelty 5.0 of 10

    A systematic review of neuro-symbolic AI in cybersecurity finds that deeper integration and causal reasoning improve performance across intrusion detection and vulnerability tasks, while identifying barriers and a res...

Reference graph

Works this paper leans on

41 extracted references · 31 canonical work pages · cited by 1 Pith paper

  1. [1]

    Deep learning methods in network intrusion detection: A survey and an objective comparison

    Sunanda Gamage and Jagath Samarabandu. Deep learning methods in network intrusion detection: A survey and an objective comparison. Journal of Network and Computer Applications, 169:102767, November 2020

    work page 2020

  2. [2]

    Why Should I Trust Your IDS?

    Zakaria Abou El Houda, Bouziane Brik, and Lyes Khoukhi. “Why Should I Trust Your IDS?”: An Explainable Deep Learning Framework for Intrusion Detection Systems in Internet of Things Networks.IEEE Open Journal of the Communications Society, 3:1164–1176, 2022. Conference Name: IEEE Open Journal of the Communications Society. 12 Algorithm 1 Simple Rule Extrac...

    work page 2022

  3. [3]

    A Unified Approach to Interpreting Model Predictions, November 2017

    Scott Lundberg and Su-In Lee. A Unified Approach to Interpreting Model Predictions, November 2017. arXiv:1705.07874 [cs]

    arXiv 2017

  4. [4]

    AI-Driven Zero Touch Network and Service Management in 5G and Beyond: Challenges and Research Directions

    Chafika Benzaid and Tarik Taleb. AI-Driven Zero Touch Network and Service Management in 5G and Beyond: Challenges and Research Directions. 34(2):186–194

    work page

  5. [5]

    Counterfactual Explanations without Opening the Black Box: Automated Decisions and the GDPR, March 2018

    Sandra Wachter, Brent Mittelstadt, and Chris Russell. Counterfactual Explanations without Opening the Black Box: Automated Decisions and the GDPR, March 2018. arXiv:1711.00399 [cs]

    arXiv 2018

  6. [6]

    Counterfactual explanations and how to find them: literature review and benchmarking

    Riccardo Guidotti. Counterfactual explanations and how to find them: literature review and benchmarking. Data Mining and Knowledge Discovery, April 2022

    work page 2022

  7. [7]

    Counterfactual Explanations for Machine Learning: Challenges Revisited, June 2021

    Sahil Verma, John Dickerson, and Keegan Hines. Counterfactual Explanations for Machine Learning: Challenges Revisited, June 2021. arXiv:2106.07756 [cs]

    arXiv 2021

  8. [8]

    Alonso, Alejandro Catala, and Martin Pereira-Farina

    Ilia Stepin, Jose M. Alonso, Alejandro Catala, and Martin Pereira-Farina. A Survey of Contrastive and Counter- factual Explanation Generation Methods for Explainable Artificial Intelligence. IEEE Access, 9:11974–12001, 2021

    work page 2021

Show all 41 references
  1. [9]

    On Counterfactual Explanations under Predictive Multiplicity

    Martin Pawelczyk, Klaus Broelemann, and Gjergji Kasneci. On Counterfactual Explanations under Predictive Multiplicity. In Proceedings of the 36th Conference on Uncertainty in Artificial Intelligence (UAI), pages 809–818. PMLR, August 2020. ISSN: 2640-3498

    2020

  2. [10]

    Equalizing Recourse across Groups, September 2019

    Vivek Gupta, Pegah Nokhiz, Chitradeep Dutta Roy, and Suresh Venkatasubramanian. Equalizing Recourse across Groups, September 2019. arXiv:1909.03166 [cs, stat]

    2019 arXiv

  3. [11]

    VCNet: A self-explaining model for realistic counterfactual generation, December 2022

    Victor Guyomard, Françoise Fessant, Thomas Guyet, Tassadit Bouadi, and Alexandre Termier. VCNet: A self-explaining model for realistic counterfactual generation, December 2022. arXiv:2212.10847 [cs]

    2022

  4. [12]

    Counterfactuals and causability in explainable artificial intelligence: Theory, algorithms, and applications

    Yu-Liang Chou, Catarina Moreira, Peter Bruza, Chun Ouyang, and Joaquim Jorge. Counterfactuals and causability in explainable artificial intelligence: Theory, algorithms, and applications. Information Fusion, 81:59–83, May 2022

    2022

  5. [13]

    Towards Non-Adversarial Algorithmic Recourse, March 2024

    Tobias Leemann, Martin Pawelczyk, Bardh Prenkaj, and Gjergji Kasneci. Towards Non-Adversarial Algorithmic Recourse, March 2024. arXiv:2403.10330 [cs]

    2024 arXiv

  6. [14]

    SoK: Taming the Triangle – On the Interplays between Fairness, Interpretability and Privacy in Machine Learning, December 2023

    Julien Ferry, Ulrich Aïvodji, Sébastien Gambs, Marie-José Huguet, and Mohamed Siala. SoK: Taming the Triangle – On the Interplays between Fairness, Interpretability and Privacy in Machine Learning, December 2023. arXiv:2312.16191 [cs]

    2023 arXiv

  7. [15]

    General Data Protection Regulation (GDPR) – Legal Text

  8. [16]

    Explainable AI for Zero-Day Attack Detection in IoT Networks Using Attention Fusion Model

    Deepa Krishnan. Explainable AI for Zero-Day Attack Detection in IoT Networks Using Attention Fusion Model

  9. [17]

    Marwa Keshk, Nickolaos Koroniotis, Nam Pham, Nour Moustafa, Benjamin Turnbull, and Albert Y . Zomaya. An explainable deep learning-enabled intrusion detection framework in IoT networks. Information Sciences, 639:119000, August 2023

    2023

  10. [18]

    Zomaya, and Zahir Tari

    Nour Moustafa, Nickolaos Koroniotis, Marwa Keshk, Albert Y . Zomaya, and Zahir Tari. Explainable Intrusion Detection for Cyber Defences in the Internet of Things: Opportunities and Solutions. IEEE Communications Surveys & Tutorials, 25(3):1775–1807, 2023. Conference Name: IEEE...

    2023

  11. [19]

    Pieter Barnard, Nicola Marchetti, and Luiz A. DaSilva. Robust Network Intrusion Detection Through Explainable Artificial Intelligence (XAI). IEEE Networking Letters, 4(3):167–171, September 2022. Conference Name: IEEE Networking Letters. 13

    2022

  12. [20]

    Evaluating Explainable AI for Deep Learning-Based Network Intrusion Detection System Alert Classification

    Rajesh Kalakoti, Risto Vaarandi, Hayretdin Bah¸ si, and Sven Nõmm. Evaluating Explainable AI for Deep Learning-Based Network Intrusion Detection System Alert Classification. pages 47–58, March 2025

    2025

  13. [21]

    Enhancing Intrusion Detection Systems With Advanced Machine Learning Techniques: An Ensemble and Explainable Artificial Intelligence (AI) Approach

    Mohammed Naif Alatawi. Enhancing Intrusion Detection Systems With Advanced Machine Learning Techniques: An Ensemble and Explainable Artificial Intelligence (AI) Approach. Security and Privacy, 8(1), January 2025

    2025

  14. [22]

    Marino, Chathurika S

    Daniel L. Marino, Chathurika S. Wickramasinghe, and Milos Manic. An Adversarial Approach for Explainable AI in Intrusion Detection Systems. In IECON 2018 - 44th Annual Conference of the IEEE Industrial Electronics Society, pages 3237–3243, October 2018. ISSN: 2577-1647

    2018

  15. [23]

    Intrusion detection framework based on causal reasoning for DDoS

    ZengRi Zeng, Wei Peng, Detian Zeng, Chong Zeng, and YiFan Chen. Intrusion detection framework based on causal reasoning for DDoS. Journal of Information Security and Applications, 65:103124, March 2022

    2022

  16. [24]

    Leveraging Explainable AI for Actionable Insights in IoT Intrusion Detection

    Sohan Gyawali, Jiaqi Huang, and Yili Jiang. Leveraging Explainable AI for Actionable Insights in IoT Intrusion Detection. In 2024 19th Annual System of Systems Engineering Conference (SoSE) , pages 92–97, June 2024. ISSN: 2835-3161

    2024

  17. [25]

    Exploring Energy Landscapes for Minimal Counterfactual Explanations: Applications in Cybersecurity and Beyond, March 2025

    Spyridon Evangelatos, Eleni Veroni, Vasilis Efthymiou, Christos Nikolopoulos, Georgios Th Papadopoulos, and Panagiotis Sarigiannidis. Exploring Energy Landscapes for Minimal Counterfactual Explanations: Applications in Cybersecurity and Beyond, March 2025. arXiv:2503.18185 [cs]

    2025 arXiv

  18. [26]

    Nguyen, and Amulya Yadav

    Hangzhi Guo, Thanh H. Nguyen, and Amulya Yadav. CounterNet: End-to-End Training of Prediction Aware Counterfactual Explanations. KDD ’23, pages 577–589, New York, NY , USA, August 2023. Association for Computing Machinery

    2023

  19. [27]

    Diffusion Models Beat GANs on Image Synthesis, June 2021

    Prafulla Dhariwal and Alex Nichol. Diffusion Models Beat GANs on Image Synthesis, June 2021. arXiv:2105.05233 [cs]

    2021 arXiv

  20. [28]

    Navigating the Structured What-If Spaces: Counterfactual Generation via Structured Diffusion, December 2023

    Nishtha Madaan and Srikanta Bedathur. Navigating the Structured What-If Spaces: Counterfactual Generation via Structured Diffusion, December 2023. arXiv:2312.13616 [cs] version: 1

    2023 arXiv

  21. [29]

    Progressive Distillation for Fast Sampling of Diffusion Models, June 2022

    Tim Salimans and Jonathan Ho. Progressive Distillation for Fast Sampling of Diffusion Models, June 2022. arXiv:2202.00512 [cs]

    2022 arXiv

  22. [30]

    Denoising Diffusion Probabilistic Models, December 2020

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising Diffusion Probabilistic Models, December 2020. arXiv:2006.11239 [cs]

    2020 arXiv

  23. [31]

    TabDDPM: Modelling Tabular Data with Diffusion Models, September 2022

    Akim Kotelnikov, Dmitry Baranchuk, Ivan Rubachev, and Artem Babenko. TabDDPM: Modelling Tabular Data with Diffusion Models, September 2022. arXiv:2209.15421 [cs]

    2022 arXiv

  24. [32]

    UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set)

    Nour Moustafa and Jill Slay. UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). In2015 Military Communications and Information Systems Conference (MilCIS), pages 1–6, November 2015

    2015

  25. [33]

    Ghorbani

    Iman Sharafaldin, Arash Habibi Lashkari, and Ali A. Ghorbani. Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization:. In Proceedings of the 4th International Conference on Information Systems Security and Privacy, pages 108–116, Funchal, Ma...

    2018

  26. [34]

    Ghorbani

    Iman Sharafaldin, Arash Habibi Lashkari, Saqib Hakak, and Ali A. Ghorbani. Developing Realistic Distributed Denial of Service (DDoS) Attack Dataset and Taxonomy. In 2019 International Carnahan Conference on Security Technology (ICCST), pages 1–8, October 2019. ISSN: 2153-0742

    2019

  27. [35]

    Explaining Machine Learning Classifiers through Diverse Counterfactual Explanations

    Ramaravind Kommiya Mothilal, Amit Sharma, and Chenhao Tan. Explaining Machine Learning Classifiers through Diverse Counterfactual Explanations. In Proceedings of the 2020 Conference on Fairness, Accountability, and Transparency, pages 607–617, January 2020. arXiv:1905.07697 [cs, stat]

    2020 arXiv

  28. [36]

    FACE: Feasible and Actionable Counterfactual Explanations

    Rafael Poyiadzi, Kacper Sokol, Raul Santos-Rodriguez, Tijl De Bie, and Peter Flach. FACE: Feasible and Actionable Counterfactual Explanations. In Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society, pages 344–350, February 2020. arXiv:1909.09369 [cs, stat]

    2020 arXiv

  29. [37]

    Learning Model-Agnostic Coun- terfactual Explanations for Tabular Data

    Martin Pawelczyk, Johannes Haug, Klaus Broelemann, and Gjergji Kasneci. Learning Model-Agnostic Coun- terfactual Explanations for Tabular Data. In Proceedings of The Web Conference 2020, pages 3126–3132, April

    2020

  30. [38]

    CARLA: A Python Library to Benchmark Algorithmic Recourse and Counterfactual Explanation Algorithms, August 2021

    Martin Pawelczyk, Sascha Bielawski, Johannes van den Heuvel, Tobias Richter, and Gjergji Kasneci. CARLA: A Python Library to Benchmark Algorithmic Recourse and Counterfactual Explanation Algorithms, August 2021. arXiv:2108.00783 [cs]

    2021 arXiv

  31. [39]

    Bench- marking Instance-Centric Counterfactual Algorithms for XAI: From White Box to Black Box

    Catarina Moreira, Yu-Liang Chou, Chihcheng Hsieh, Chun Ouyang, João Pereira, and Joaquim Jorge. Bench- marking Instance-Centric Counterfactual Algorithms for XAI: From White Box to Black Box. ACM Computing Surveys, page 3672553, June 2024. 14

    2024

  32. [40]

    Evaluation of Instance-Based Explanations: An In-Depth Analysis of Counterfac- tual Evaluation Metrics, Challenges, and the CEval Toolkit

    Betül Bayrak and Kerstin Bach. Evaluation of Instance-Based Explanations: An In-Depth Analysis of Counterfac- tual Evaluation Metrics, Challenges, and the CEval Toolkit. IEEE Access, 12:137683–137695, 2024. Conference Name: IEEE Access. 15

    2024

  33. [2020]

    arXiv:1910.09398 [cs, stat]

    1910 arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.