Explainable Unsupervised Machine Learning for Cyber-Physical Systems

Abstract

Cyber-Physical Systems (CPSs) play a critical role in our modern infrastructure due to their capability to connect computing resources with physical systems. As such, topics such as reliability, performance, and security of CPSs continue to receive increased attention from the research community. CPSs produce massive amounts of data, creating opportunities to use predictive Machine Learning (ML) models for performance monitoring and optimization, preventive maintenance, and threat detection. However, the "black-box" nature of complex ML models is a drawback when used in safety-critical systems such as CPSs. While explainable ML has been an active research area in recent years, much of the work has been focused on supervised learning. As CPSs rapidly produce massive amounts of unlabeled data, relying on supervised learning alone is not sufficient for data-driven decision making in CPSs. Therefore, if we are to maximize the use of ML in CPSs, it is necessary to have explainable unsupervised ML models.In this paper, we outline how unsupervised explainable ML could be used within CPSs. We review the existing work in unsupervised ML, present initial desiderata of explainable unsupervised ML for CPS, and present a Self-Organizing Maps based explainable clustering methodology which generates global and local explanations. We evaluate the fidelity of the generated explanations using feature perturbation techniques. The results show that the proposed method identifies the most important features responsible for the decision-making process of Self-organizing Maps. Further, we demonstrated that explainable Self-Organizing Maps are a strong candidate for explainable unsupervised machine learning by comparing its model capabilities and limitations with current explainable unsupervised methods.

Deep Learning Based Fusion Model for Multivariate LTE Traffic Forecasting and Optimized Radio Parameter Estimation

“…SOM is one kind of unsupervised neural network with only two layers [20]. One input layer and another mapping layer also work as output layers.…”

Explainable Artificial Intelligence in CyberSecurity: A Survey

“…For example, a Cyber-Physical attacker may take down cameras, switch off the lights in a building, cause a car to wander off the road, or make a drone land in the hands of adversaries. Wickramasinghe et al [219] propose a Desiderata on Explainability of unsupervised approaches in Cyber-Physical Systems since they generate a large amount of unlabeled data. These are potential solutions for meaningfully mining these data, maintaining and improving desired functions, and improving the safety of these systems.…”

Explainable Intrusion Detection Systems (X-IDS): A Survey of Current Methods, Challenges, and Opportunities

“…Clustering algorithms that can be explained have several advantages. The primary benefit of explainable clustering is that it summarizes the input behavior patterns within clusters, enabling users to comprehend the clusters' underlying commonalities [120]. As stated in Section III-A there are various clustering algorithms available.…”

“…Another model based on HSOM is proposed in [143]. Wickramasinghe et al [120] developed a novel model-specific explainable technique for the SOM algorithm that generates both local and global explanations for Cyber-Physical Systems (CPS) security. They used the SOMs training approach (winner-take-all algorithm) together with visual data mining capabilities (Histograms, t-SNE, Heat Maps, and U-Matrix) of SOMs to make the algorithm explainable.…”