Opening the Deep Pandora Box: Explainable Traffic Classification

Beliard, Cedric; Finamore, Alessandro; Rossi, Dario

doi:10.1109/infocomwkshps50562.2020.9162704

Cited by 19 publications

(14 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Finally, deployability issues especially includes aspects related to model inference, such as auditing/explainability of classification decisions for the non experts (which has practical relevance since unlike decision trees, DL models have no direct explanation [60], [61]) as well as more precise assessment of computational costs (e.g., to ensure the model execution is within the CPU/energy budget [19]), an aspect that this paper briefly covers but does not fully elucidate.…”

Section: Summary and Discussionmentioning

confidence: 99%

Deep Learning and Traffic Classification: Lessons learned from a commercial-grade dataset with hundreds of encrypted and zero-day applications

Yang,

Finamore,

Jun

et al. 2021

Preprint

Self Cite

View full text Add to dashboard Cite

The increasing success of Machine Learning (ML) and Deep Learning (DL) has recently re-sparked interest towards traffic classification. While classification of known traffic is a well investigated subject with supervised classification tools (such as ML and DL models) are known to provide satisfactory performance, detection of unknown (or zero-day) traffic is more challenging and typically handled by unsupervised techniques (such as clustering algorithms).In this paper, we share our experience on a commercialgrade DL traffic classification engine that is able to (i) identify known applications from encrypted traffic, as well as (ii) handle unknown zero-day applications. In particular, our contribution for (i) is to perform a thorough assessment of state of the art traffic classifiers in commercial-grade settings comprising few thousands of very fine grained application labels, as opposite to the few tens of classes generally targeted in academic evaluations. Additionally, we contribute to the problem of (ii) detection of zero-day applications by proposing a novel technique, tailored for DL models, that is significantly more accurate and light-weight than the state of the art.Summarizing our main findings, we gather that (i) while ML and DL models are both equally able to provide satisfactory solution for classification of known traffic, however (ii) the nonlinear feature extraction process of the DL backbone provides sizeable advantages for the detection of unknown classes.Index Terms-Machine learning, Data mining and (big) data analysis, Network monitoring and measurements.

show abstract

Section: Summary and Discussionmentioning

confidence: 99%

Deep Learning and Traffic Classification: Lessons learned from a commercial-grade dataset with hundreds of encrypted and zero-day applications

Yang,

Finamore,

Jun

et al. 2021

Preprint

Self Cite

View full text Add to dashboard Cite

show abstract

“…Traffic classification can be formulated as a Multivariate Time Series (MTS) classification task, where the input is packet-level data (e.g., packet size, direction) related to a single flow 1 , and the output is an application label. The state-of-the-art approaches [1,8,28,29,32,38,48] adopt deep learning methods (vanilla CNN and/or LSTM) with heavyweight architectures (from 1M to 2M weights), and do not discuss the impact of their model size on the accuracy and inference time. Some of them [8,32,38] propose classifiers along with an explainability method to support their predictions.…”

Section: Related Workmentioning

confidence: 99%

“…The state-of-the-art approaches [1,8,28,29,32,38,48] adopt deep learning methods (vanilla CNN and/or LSTM) with heavyweight architectures (from 1M to 2M weights), and do not discuss the impact of their model size on the accuracy and inference time. Some of them [8,32,38] propose classifiers along with an explainability method to support their predictions. However, the post hoc explainability methods employed, such as SHAP [30], cannot provide perfectly faithful explanations with respect to the original model [40].…”

Section: Related Workmentioning

confidence: 99%

“…The sharp rise of encrypted traffic in the last decade hampered traditional rule-based techniques, pushing the adoption of machine learning-assisted classification [33] to supplant deep packet inspection [12,25]. Inspired by seminal work [13], a recent wave [1,3,8,28,29,32,38,48] of deep learning models (CNNs or recurrent architectures like Long Short-Term Memory -LSTMs) successfully tackles the encryption challenge by just leveraging the size and direction of the first few packets in a flow [13].…”

Section: Introductionmentioning

confidence: 99%

“…Nonetheless, the faithfulness of such a model should not negatively impact the prediction performance, nor come at the cost of an increased model computational and memory complexity. A few models in traffic classification [8,32,38] account for explainability, but they cannot provide faithful explainability as they rely on post hoc model-agnostic explainability methods [40]. With the above constraints in mind, we therefore propose a lightweight, efficient and explainable-by-design CNN for traffic classification, and evaluate it on a commercial-grade dataset.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

A Lightweight, Efficient and Explainable-by-Design Convolutional Neural Network for Internet Traffic Classification

Fauvel¹,

Finamore²,

Yang³

et al. 2022

Preprint

Self Cite

View full text Add to dashboard Cite

Traffic classification, i.e. the identification of the type of applications flowing in a network, is a strategic task for numerous activities (e.g., intrusion detection, routing). This task faces some critical challenges that current deep learning approaches do not address. The design of current approaches do not take into consideration the fact that networking hardware (e.g., routers) often runs with limited computational resources. Further, they do not meet the need for faithful explainability highlighted by regulatory bodies. Finally, these traffic classifiers are evaluated on small datasets which fail to reflect the diversity of applications in real commercial settings.Therefore, this paper introduces a Lightweight, Efficient and eXplainable-by-design convolutional neural network (LEXNet) for Internet traffic classification, which relies on a new residual block (for lightweight and efficiency purposes) and prototype layer (for explainability). Based on a commercial-grade dataset, our evaluation shows that LEXNet succeeds to maintain the same accuracy as the best performing state-of-the-art neural network, while providing the additional features previously mentioned. Moreover, we demonstrate that LEXNet significantly reduces the model size and inference time compared to the state-of-the-art neural networks with explainability-by-design and post hoc explainability methods. Finally, we illustrate the explainability feature of our approach, which stems from the communication of detected application prototypes to the end-user, and we highlight the faithfulness of LEXNet explanations through a comparison with post hoc methods.

show abstract

Explainable artificial intelligence for feature selection in network traffic classification: A comparative study

Khani,

Moeinaddini,

Abnavi

et al. 2024

Trans Emerging Tel Tech

View full text Add to dashboard Cite

Over the past decade, there has been a growing surge of interest in leveraging artificial intelligence and machine learning models to address real‐world challenges within the field of telecommunications and networking. Among these challenges, network traffic classification has consistently remained a key focal point within the community. The emergence of new paradigms such as internet of things has added complexity to this challenge, owing to the diverse array of traffic classes it introduces. This complexity is further compounded when dealing with encrypted traffic data. In the context of this paper, we employ explainable artificial intelligence (XAI) techniques to offer insightful explanations for the task of classifying encrypted network traffic. Our approach involves presenting a ranked list of the model's input features, organized based on their significance in influencing the classifier's predictions. These ranked lists shed light on the underlying functionality of the encrypted traffic classification model, enabling users to discern which features hold greater importance in shaping the model's output by harnessing the insights provided by XAI approaches. Moreover, we carry out a quantitative assessment and comparison of the results generated by these XAI methods and outputs of three other conventional, widely adopted feature selection approaches, utilizing them as feature selection techniques when applied to a convolutional neural network for classifying data from the CIC‐Darknet2020 and CIC‐IDS2017 datasets. The results show that XAI techniques have high performance in feature selection for network traffic classification.

show abstract

Opening the Deep Pandora Box: Explainable Traffic Classification

Cited by 19 publications

References 6 publications

Deep Learning and Traffic Classification: Lessons learned from a commercial-grade dataset with hundreds of encrypted and zero-day applications

Deep Learning and Traffic Classification: Lessons learned from a commercial-grade dataset with hundreds of encrypted and zero-day applications

A Lightweight, Efficient and Explainable-by-Design Convolutional Neural Network for Internet Traffic Classification

Explainable artificial intelligence for feature selection in network traffic classification: A comparative study

Contact Info

Product

Resources

About