Towards understanding the behavior of image-based network intrusion detection systems

Network Intrusion Detection Systems play a pivotal role in preventing cyber attacks by identifying threats within computer networks. Recent advancements in deep learning techniques positioned them as highly effective methods in detecting a diverse range of cyber attacks. However, the ”Black-Box” nature of deep models makes understanding their decisions very challenging, and renders them susceptible to adversarial attacks. In this paper, we propose the use of Explainable AI (XAI) approaches in deep-learning-based network traffic classifiers to validate their decisions’ rationale and soundness. In particular, we combine the popular Grad-CAM technique with a reverse lookup algorithm to explain models trained using image-transformed raw network traffic sessions, encompassing general, malware, and encrypted traffic data. Model behaviors were analyzed by mapping the highly impacting pixels to their corresponding raw features, to facilitate investigating the meaningfulness of the features learned by the model. Experimental results indicate cases of consistent highlighting of pixels associated with network layers across specific traffic types. However, models occasionally used unexpected features during the classification process, raising security vulnerability concerns that merit serious investigation. The proposed approach serves as a valid method to explain the behavior of general black-box image-based network traffic classification models and assess their robustness.