Abstract:
Understanding network traffic patterns is crucial in today's interconnected world, particularly with the increasing use of communication and collaboration apps (CC apps)....Show MoreMetadata
Abstract:
Understanding network traffic patterns is crucial in today's interconnected world, particularly with the increasing use of communication and collaboration apps (CC apps). These allow different user activities (chat, audio, video), resulting specifically hard to classify. Despite promising results of DL for traffic classification (TC), its opacity poses challenges in understanding the decision-making process and hinders its widespread adoption. To cope with these limitations, we leverage eXplainable AI (XAI) techniques to open the “black box” and interpret Mimetic-all, a state-of-art multimodal DL architecture. Our goal is to analyze joint app-activity classification in an early fashion- viz. with the first packets of each bidirectional communication-while evaluating the contribution of each traffic input- packet header fields (SEQ), payload bytes (PAY), and contextual inputs from concurrent biflows (Context)-to the final prediction. Our findings show that although the inclusion of Context enhances performance, its importance is relatively lower w.r.t. SEQ and PAY in TC. Moreover, within PAY, specific byte subsets are identified as more influential for TC compared to others, whereas in SEQ, the length of transport-level payload holds greater importance than other header fields.
Published in: 2024 IFIP Networking Conference (IFIP Networking)
Date of Conference: 03-06 June 2024
Date Added to IEEE Xplore: 15 August 2024
ISBN Information:
Electronic ISSN: 1861-2288