New visual tool explains AI network traffic classifications
A rejected EuroVis paper reveals a prototype for spotting misleading deep learning features.
Deep learning models excel at classifying network traffic, but their explanations often fail when a single class contains divergent patterns. That's the problem tackled by Igor Cherepanov, David Sessler, Alex Ulmer, Felix Wagner, Thorsten May, and Jörn Kohlhammer in a new arXiv preprint. Their visual-interactive system aggregates class activation maps across multiple samples to generate global explanations for a predicted class, giving network experts a comprehensive overview of what the model actually learned. This makes it possible to spot misleading features that could undermine intrusion detection or next-generation firewall rules.
The prototype supports visual exploration and refinement, letting experts detect new patterns and extract descriptive rules for managing networks. It also helps ML experts separate or merge classes, leading to more accurate and reliable deep learning models. The researchers evaluated their system with experts in both machine learning and network analysis, confirming its practical value. Notably, the paper was rejected from EuroVis 2025 but is being resubmitted—a reminder that even rejected research can offer useful insights for the AI ops community.
- Cherepanov et al. aggregate class activation maps across samples to produce global explanations for network traffic classification.
- The interactive prototype supports rule extraction for next-generation firewalls and identification of misleading features.
- Evaluation with ML and network security experts shows potential for class merging and splitting to improve DL model accuracy.
Why It Matters
Brings explainable AI to network security, helping analysts trust and tune deep learning models for intrusion detection.