Location
Hilton Waikoloa Village, Hawaii
Event Website
https://hicss.hawaii.edu/
Start Date
7-1-2025 12:00 AM
End Date
10-1-2025 12:00 AM
Description
We compare a cognitive salience algorithm with SHAPley values to show how cognitive salience provides an alternate measure of the extent to which each feature is responsible for making a particular decision in a given context. We show how local cognitive salience is computed in near real-time. By being embedded in cognitive mechanisms, cognitive salience is influenced by recency, frequency, and order effects appropriate to interpreting both cognitive model and arbitrary machine learning output. Applying this technique to intrusion detection datasets (UNSW-NB15, CICIDS2017, NSL-KDD), we compute the salience of each feature for any given classification. By tracing (i.e., clamping) our model’s decisions to that of a specific classification technique or individual decision maker, we are able to provide measures of model-agnostic salience. We then compare our output to SHAP values, which are a comparable game-theoretic measure of local and global feature importance. We show how our salience is more scalable than Tree-based SHAP techniques and discuss when predictions vary.
Recommended Citation
Thomson, Robert; Cranford, Edward; and Lebiere, Christian, "Investigating Cognitive Salience and SHAPley Values for Model Explainability in Intrusion Detection Datasets" (2025). Hawaii International Conference on System Sciences 2025 (HICSS-58). 8.
https://aisel.aisnet.org/hicss-58/da/cyber_deception/8
Investigating Cognitive Salience and SHAPley Values for Model Explainability in Intrusion Detection Datasets
Hilton Waikoloa Village, Hawaii
We compare a cognitive salience algorithm with SHAPley values to show how cognitive salience provides an alternate measure of the extent to which each feature is responsible for making a particular decision in a given context. We show how local cognitive salience is computed in near real-time. By being embedded in cognitive mechanisms, cognitive salience is influenced by recency, frequency, and order effects appropriate to interpreting both cognitive model and arbitrary machine learning output. Applying this technique to intrusion detection datasets (UNSW-NB15, CICIDS2017, NSL-KDD), we compute the salience of each feature for any given classification. By tracing (i.e., clamping) our model’s decisions to that of a specific classification technique or individual decision maker, we are able to provide measures of model-agnostic salience. We then compare our output to SHAP values, which are a comparable game-theoretic measure of local and global feature importance. We show how our salience is more scalable than Tree-based SHAP techniques and discuss when predictions vary.
https://aisel.aisnet.org/hicss-58/da/cyber_deception/8