Visualization Of Class Activation Maps To Explain AI Classification Of Network Packet Captures
This work addresses the need for explainability in network analytics to increase expert trust and enable new insights, though it appears incremental as it applies existing explanation methods to a specific domain.
The paper tackles the problem of explaining AI classifications of network traffic by developing a visual interactive tool that combines classification with explanation techniques, aiming to bridge the gap between experts, algorithms, and data.
The classification of internet traffic has become increasingly important due to the rapid growth of today's networks and applications. The number of connections and the addition of new applications in our networks causes a vast amount of log data and complicates the search for common patterns by experts. Finding such patterns among specific classes of applications is necessary to fulfill various requirements in network analytics. Deep learning methods provide both feature extraction and classification from data in a single system. However, these networks are very complex and are used as black-box models, which weakens the experts' trust in the classifications. Moreover, by using them as a black-box, new knowledge cannot be obtained from the model predictions despite their excellent performance. Therefore, the explainability of the classifications is crucial. Besides increasing trust, the explanation can be used for model evaluation gaining new insights from the data and improving the model. In this paper, we present a visual interactive tool that combines the classification of network data with an explanation technique to form an interface between experts, algorithms, and data.