Visualization Of Class Activation Maps To Explain AI Classification Of Network Packet Captures

TL;DR

This paper introduces a visual interactive tool that combines deep learning-based classification of network traffic with explainability techniques to enhance trust, understanding, and evaluation of AI models in network analytics.

Contribution

The paper presents a novel visual explanation method for deep learning models classifying network packet captures, improving interpretability and trust in AI-based network analysis.

Findings

Enhanced interpretability of network traffic classification models

Increased trust of experts in AI predictions

Facilitated model evaluation and knowledge extraction

Abstract

The classification of internet traffic has become increasingly important due to the rapid growth of today's networks and applications. The number of connections and the addition of new applications in our networks causes a vast amount of log data and complicates the search for common patterns by experts. Finding such patterns among specific classes of applications is necessary to fulfill various requirements in network analytics. Deep learning methods provide both feature extraction and classification from data in a single system. However, these networks are very complex and are used as black-box models, which weakens the experts' trust in the classifications. Moreover, by using them as a black-box, new knowledge cannot be obtained from the model predictions despite their excellent performance. Therefore, the explainability of the classifications is crucial. Besides increasing trust, the explanation can be used for model evaluation gaining new insights from the data and improving the model. In this paper, we present a visual interactive tool that combines the classification of network data with an explanation technique to form an interface between experts, algorithms, and data.