When Relationships Break: Interpreting Network Traffic Anomalies via Dependency Violations

2026-08-27

AI Summary

该研究提出XION方法，基于良性流量建模网络流特征关系，通过检测异常依赖关系来识别攻击，并支持警报后分析，提高了检测效率和理解。

Abstract

Current research on security monitoring is increasingly focusing on machine-learning-based approaches, but caveats remain. In addition to huge computational overhead, one concern is the lack of insights into "why" alerts are raised. Existing interpretability approaches rely on feature attribution methods that ignore dependencies among features or on causal modeling that requires extensive domain knowledge or computational resources. This work proposes XION, a method for modeling relationships among network-flow features based on benign traffic only. During detection, anomalies are identified through violations of expected feature dependencies. Further, XION supports post-alert analysis by identifying which feature relationships break, when they break along the attack timeline, and how dependency violations evolve relatively to other identified violations. XION is evaluated on standard IDS datasets and compared against an Isolation Forest (IF) baseline across multiple attack scenarios, including both volumetric and stealthier attacks. Results show that XION matches or exceeds IF recall in all evaluated scenarios, while requiring up to 7x less inference time. At the post-alert stage, the dependency-violation analysis reveals temporal and structural patterns consistent with known attack behaviors, which IF alone could not contribute to. Together, these findings confirm that attacks indeed disrupt feature dependencies learned from benign traffic, and that these disruptions provide additional information for understanding an alert.

Problem

• security monitoring
• machine learning
• feature dependencies
• interpretability
• anomalies

Innovation

• Dependency Violations
• Network Traffic Anomalies
• Feature Relationships
• Post-alert Analysis
• XION