XAI-Driven Malicious Encrypted Traffic Detection and Characterization to Enhance Information Security
Bibliographic record
Abstract
Securing information through encryption is essential in data communication, but to effectively detect malicious activities, it is crucial to distinguish between encrypted and non-encrypted traffic. Traditional encrypted traffic classification methods, including rule-based systems and conventional machine learning approaches, often struggle with scalability, generalization, and class imbalance, leading to suboptimal classification performance. This study introduces a novel hybrid model for encrypted traffic classification, integrating Multi-Head Attention mechanisms for feature enhancement and LightGBM as the final classifier. The proposed model follows a two-step classification process: first, performing binary classification to separate encrypted and non-encrypted traffic, and second, applying multi-class classification to categorize encrypted traffic into TOR, VPN, I2P, Zeronet, and Freenet. To improve model interpretability, SHAP is employed to validate the importance of attention-based features, while LIME provides insights into misclassified instances, enabling adjustments such as weight threshold tuning and handling class imbalances. Furthermore, this study incorporates a refined dataset preprocessing pipeline, leveraging NTL Flowlyzer—an advanced traffic analyzer that extracts over 400 features, including entropy-based attributes. To address class imbalance issues, strategic adjustments such as SMOTE augmentation for Freenet and class-specific threshold tuning were applied based on SHAP and LIME insights, resulting in improved classification performance. The experimental evaluation demonstrates that the proposed hybrid model outperforms existing approaches in accuracy, precision ,and recall while maintaining efficiency in both time and computational complexity. By integrating explainable AI techniques and adaptive optimization strategies, our approach enhances classification performance and improves the transparency and interpretability of encrypted traffic detection. These findings contribute to advancing cybersecurity by enabling more robust and interpretable encrypted traffic classification models.
Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.
How this classification was reachedexpand
Full frame machine prediction
Teacher imitationNot calibrated prevalence, not ground truth. Human validation pending. The Gemma side is a direct model label for every work in the frame, read from the title-only record. The Codex side is a classifier learned from the 10,348 direct Codex labels and calibrated to design-weighted sample rates; fields without enough sample support carry no Codex call. Candidate is the union of the two sides; consensus is their intersection. These outputs are machine_predicted_unvalidated and are not human labels.
Distilled classifier scores by category (both heads)
| Category | Codex | Gemma |
|---|---|---|
| Metaresearch | 0.001 | 0.002 |
| Meta-epidemiology (narrow) | 0.001 | 0.000 |
| Meta-epidemiology (broad) | 0.000 | 0.000 |
| Bibliometrics | 0.001 | 0.001 |
| Science and technology studies | 0.000 | 0.000 |
| Scholarly communication | 0.001 | 0.002 |
| Open science | 0.001 | 0.001 |
| Research integrity | 0.000 | 0.001 |
| Insufficient payload (model declined to judge) | 0.001 | 0.001 |
Machine scores (provisional)
The two teacher heads of the student model, read on this work. A score orders the frame for review; it never asserts a category, and the validation status ships verbatim with every row.
Baseline scores from an immature model (maturity gate not passed, 7 training rounds). Scores rank; they never assert a category.
score_only:v0-immature-baseline · verbatim from the scoring run: score_only means the number may rank works, and no category label ships from itClassification
machine, unvalidatedMachine predicted; a candidate call from one source (direct Gemma or distilled Codex), not a consensus.
How this classification was reached, model by model and score by score, is at the end of the page under "How this classification was reached".