DEV-ETA: An Interpretable Detection Framework for Encrypted Malicious Traffic

Luming Yang, Shaojing Fu*, Yongjun Wang, Kaitai Liang, Fan Mo, Bo Liu

*Corresponding author for this work

Research output: Contribution to journalArticleScientificpeer-review

Abstract

Traffic encrypted technology enables Internet users to protect their data secrecy, but it also brings a challenge to malicious package detection. To tackle this issue, researchers have investigated into encrypted traffic analysis (ETA) in recent years. Existing works, however, only focus on the accuracy of malicious flow identification. Using ETA as a technical black box, they pay little attention to the internal details and explanation of models. In this paper, we, for the first time, introduce interpretable machine learning into ETA. We aim to provide a reasonable explanation for detection results, so as to enable one to understand and further trust network security analysts. We develop a complete analysis framework, named DEV-ETA (detection, explanation and verification of ETA). DEV-ETA applies post hoc interpretation methods to explain the detection results and verify the explanation using the joint distribution of support features on the dataset. We run thorough experiments to explain the detection result using three popular explanation approaches, namely SHAP, LIME and MSS, and we verify the explanation via the feature distribution plot. The experimental results show that our design can interpret the detection result of ETA model instead of just simply treating the model as a black box.

Original languageEnglish
Pages (from-to)1213-1227
Number of pages15
JournalComputer Journal
Volume66
Issue number5
DOIs
Publication statusPublished - 2023

Keywords

  • encrypted traffic analysis
  • interpretable machine learning
  • malicious traffic detection
  • support feature

Fingerprint

Dive into the research topics of 'DEV-ETA: An Interpretable Detection Framework for Encrypted Malicious Traffic'. Together they form a unique fingerprint.

Cite this