Ui-Jun Baek

In modern society, the Security Operation Centers (SOCs) play a pivotal role in protecting the digital assets of individuals and organizations by detecting and responding to various cyber threats in real time. Recently, many SOCs have incorporated Artificial Intelligence (AI) technologies. This adoption enables faster and more accurate threat analysis and automated response. Along with AI, Explainable Artificial Intelligence (XAI) has been introduced to enhance the transparency and interpretability of AI models. These improvements further increase the reliability and efficiency of SOC operations. However, challenges still remain, such as XAI explanations being insufficient to support decision-making by analysts and latency caused by explanation generation. These issues continue to hinder the practical deployment of XAI in real-world SOC environments. This paper defines XAI explanations insufficient for SOC analysts to accept AI prediction rationales and latency between AI detection and providing XAI explanations as the primary challenges in applying explainable models to real-world SOC environments. To address these challenges, we propose a three-stage XAI framework based on TreeSHAP. The proposed method improves interpretability through analyst-friendly input construction. It also mitigates multicollinearity and introduces a novel ranking scheme that accounts for both consistency and practical influence. These improvements enable SOC analysts to accept AI predictions by providing sufficient rationales. Experimental results demonstrate that the proposed method achieves the highest Intersection-over-Union (IoU), reflecting human acceptance, across various AI–XAI combinations, while maintaining low explanation latency. Specifically, the proposed method maintains over 25 times lower explanation latency than conventional XAI methods such as KernelSHAP and LIME. These results confirm that our framework is acceptable to SOC analysts and operationally practical in real-world SOC environments.

As the Internet evolves, application traffic is becoming increasingly diverse and complex, leading network administrators to demand more accurate application traffic classification. Various deep learning-based application traffic classification methods have clearly achieved significant success, demonstrating superior classification performance compared to traditional heuristic classification approaches. However, achieving accuracy while maintaining time-efficiency and high generalization performance remains a challenge. We propose an end-to-end learning method that incorporates a model-selection-based ensemble mechanism to improve the performance–inference time trade-off of application traffic classifiers. Evaluated on two public datasets and one private dataset, our proposed method improves classification accuracy across all datasets while ensuring reasonable inference times compared to nine classification methods.

The classification of encrypted traffic plays a crucial role in network management and security. As encrypted network traffic becomes increasingly complicated and challenging to analyze, there is a growing need for more efficient and comprehensive analytical approaches. Our proposed method introduces a novel approach to network traffic classification, utilizing multi-task learning to simultaneously train multiple tasks within a single model. To validate the proposed method, we conducted experiments using the ISCX 2016 VPN/Non-VPN dataset, consisting of three tasks. The proposed method outperformed the majority of existing methods in classification with 99.29%, 97.38%, and 96.89% accuracy in three tasks (i.e., encapsulation, category, and application classification, respectively). The efficiency of the proposed method also demonstrated outstanding performance when compared to methods excluding lightweight models. The proposed approach demonstrates accurate and efficient multi-task classification on encrypted traffic.

As IT technology advances, the number and types of applications, such as SNS, content, and shopping, have increased across various fields, leading to the emergence of complex and diverse application traffic. As a result, the demand for effective network operation, management, and analysis has increased. In particular, service or application traffic classification research is an important area of study in network management. Web services are composed of a combination of multiple applications, and one or more application traffic can be mixed within service traffic. However, most existing research only classifies application traffic by service unit, resulting in high misclassification rates and making detailed management impossible. To address this issue, this paper proposes three multitask learning methods for application traffic classification using the relationships among tasks composed of browsers, protocols, services, and application units. The proposed methods aim to improve classification performance under the assumption that there are relationships between tasks. Experimental results demonstrate that by utilizing relationships between various tasks, the proposed method can classify applications with 4.4%p higher accuracy. Furthermore, the proposed methods can provide network administrators with information about multiple perspectives with high confidence, and the generalized multitask methods are freely portable to other backbone networks.

While user-oriented service industries are rapidly growing, various network devices provide these services through different access paths. Accordingly, the network flow is also increasing explosively. As demand for management related to limited network resources increases, the network traffic classification grows to prominence. Usually, a quick classification task was possible with hundreds of data composed of dozens of features. Afterward, deep learning models have proliferated owing to an outstanding performance that overwhelms existing performance based on hundreds of thousands of features and data. However, the deep learning models showing one of the best performances cannot be free from two facts. One is a lot of time and resource consumption. The other is an uncertain explanation of the process. We solved these problems. Firstly, we used two methods to overcome resource constraints. We modified the DistilBERT applied with knowledge distillation for using a compressed model and securing a remarkable performance. We used a lightweight packet with a header and partial payload for feature reduction. Consequently, our XENTC can process four multi-attribute packets simultaneously and effectively by removing the superfluity of features. And it achieved 97.0~98.1% F1 scores. The required time to classify a packet using a trained model is 0.0093 seconds. Therefore, it can be one of the feasible solutions. Secondly, to approach human-understandable XAI, we analyzed the relationships between the features by associating them with the packet structure. At the specific point of the model’s finished training, it was revealed what the important features of the packet were by counting the Top-5 number of times among the attention values. In addition, we visualized the classification performance of the model using t-SNE to enable intuitive understanding.

KSII Transactions on Internet and Information Systems TIIS Paper Details

KSII Transactions on Internet and Information Systems TIIS Paper Details