PaperlayerView exact revision on arXiv

Source-linked AI summary

When Relationships Break: Interpreting Network Traffic Anomalies via Dependency Violations

Federica Uccello, Simin Nadjm-Tehrani

arXiv:2608.26831v1cs.CR

TL;DR

Machine-learning intrusion detectors can be costly and difficult to interpret, while existing approaches may ignore feature dependencies or require causal expertise. XION learns feature dependencies from benign traffic, detects violations, and analyzes their timing and structure. Across two IDS datasets, it achieves anomaly signals comparable to Isolation Forest and reveals attack-related disruption patterns for post-alert investigation.

  • Problem

    ML-based intrusion detection can have high computational overhead and limited interpretability, while existing explanation methods ignore feature dependencies or causal methods require substantial expertise.

  • Method

    XION learns a feature-dependency structure from benign network traffic and detects and interprets anomalies through violations of those dependencies.

  • Results

    Across CIC-IDS-2018 and CIC-UNSW-NB15, XION produces anomaly signals comparable to Isolation Forest and captures distinct temporal and structural disruption patterns across attack behaviors.

  • Takeaways & Limitations

    Dependency violations reveal which relationships break, when they break, and how they propagate, providing structural insight for post-alert investigation without explicit causal models or domain-specific rules.

  • Takeaways & Limitations

    The evaluation relies on pre-collected datasets that may not capture the diversity and variability of real-world network traffic, and dataset artifacts may limit transfer to operational networks.

Abstract

from arXiv · show

Current research on security monitoring is increasingly focusing on machine-learning-based approaches, but caveats remain. In addition to huge computational overhead, one concern is the lack of insights into "why" alerts are raised. Existing interpretability approaches rely on feature attribution methods that ignore dependencies among features or on causal modeling that requires extensive domain knowledge or computational resources. This work proposes XION, a method for modeling relationships among network-flow features based on benign traffic only. During detection, anomalies are identified through violations of expected feature dependencies. Further, XION supports post-alert analysis by identifying which feature relationships break, when they break along the attack timeline, and how dependency violations evolve relatively to other identified violations. XION is evaluated on standard IDS datasets and compared against an Isolation Forest (IF) baseline across multiple attack scenarios, including both volumetric and stealthier attacks. Results show that XION matches or exceeds IF recall in all evaluated scenarios, while requiring up to 7x less inference time. At the post-alert stage, the dependency-violation analysis reveals temporal and structural patterns consistent with known attack behaviors, which IF alone could not contribute to. Together, these findings confirm that attacks indeed disrupt feature dependencies learned from benign traffic, and that these disruptions provide additional information for understanding an alert.

1 Introduction

XION addresses the computational and interpretability limitations of anomaly-based intrusion detection by learning benign feature dependencies and analyzing their violations during attacks.

  • ML-based intrusion detectors can incur expensive computational overhead and provide limited insight into why alerts are triggered.
  • Existing explainability methods typically treat network-traffic features as independent despite their interdependent and evolving relationships.
  • XION explores whether benign-condition feature dependencies can reveal anomalies during network operation.
  • Dependency violations provide diagnostic signals by showing which relationships break, when they break, and how violations evolve beyond aggregate anomaly scores.
  • XION unifies anomaly detection and post-alert analysis through feature-level dependency modeling.
  • On two open IDS datasets, XION produces anomaly signals as good as Isolation Forest while requiring much lower inference time.

2 Related Work

Related work spans dependency-aware, provenance-based, causal, and generic anomaly-detection methods; XION occupies a lightweight middle ground by modeling benign statistical dependencies for detection and interpretation.

  • Provenance-based approaches model structural and temporal relationships among system entities but incur computational overhead and expert effort.
  • Traffic-focused methods detect anomalies from correlated features, reconstruction errors, or deviations in inter-flow covariance learned under benign conditions.
  • XION learns one dependency structure from benign traffic and uses local feature-prediction models, unlike TVGL’s repeated time-varying graph estimation.
  • KNN, LOF, and IF are sample-centric detectors based on distance, density, or isolation, whereas XION evaluates consistency among learned feature relationships.
  • Feature-attribution approaches use important features as proxies for causes without explicitly modeling causality or dependencies.
  • Causal root-cause methods can require causal modeling and extensive domain knowledge, while XION exposes disrupted statistical relationships without causal claims.
  • XION provides additional information beyond classical anomaly detectors while retaining low computational cost relative to full causal discovery.

3 Background

The background distinguishes correlation, causality, and conditional dependency, then introduces Gaussian graphical models as the mathematical basis for representing XION’s feature relationships.

  • 3.1 Correlation, Causality, and Dependency: Because high-fidelity models of complex systems are difficult, analysis often focuses on observed feature patterns and relationships over time.
  • 3.1 Correlation, Causality, and Dependency: Correlation measures statistical association but does not imply that one variable influences another.
  • 3.1 Correlation, Causality, and Dependency: Causality denotes directional relationships in which changing one variable directly affects another and carries intervention semantics.
  • 3.1 Correlation, Causality, and Dependency: Conditional dependency measures whether one variable provides information about another after accounting for additional variables.
  • 3.1 Correlation, Causality, and Dependency: Dependency modeling lies between correlation and causal inference because it captures conditional statistical relationships without requiring causal-discovery assumptions, interventions, or extensive domain knowledge.
  • 3.2 Gaussian Graphical Models: Gaussian graphical models represent conditional dependencies using a covariance matrix Σ and precision matrix Θ = Σ^-1.
  • 3.2 Gaussian Graphical Models: In a Gaussian graphical model, zeros in Θ correspond to conditional independence after accounting for all remaining variables.
  • 3.2 Gaussian Graphical Models: Nonparanormal models extend Gaussian graphical models to non-Gaussian data through monotonic rank-based or quantile transformations.

4 Method

XION learns feature dependencies from benign network traffic and detects anomalies when those relationships are violated. It also analyzes which relationships break and when, supporting post-alert interpretation while evaluating computational cost against an ML baseline.

  • Research questions: XION tests whether benign-data feature dependencies are violated during attacks and whether those violations help interpret anomaly alerts.
  • Method overview: The method learns feature dependencies from benign traffic and analyzes their violations during anomalous activity.
  • Threat model: The threat model excludes data poisoning, monitoring-infrastructure manipulation, and adaptive evasion using knowledge of the detector.
  • Modeling benign relationships: XION estimates a sparse precision matrix whose sparsity pattern defines an undirected graph of conditional dependencies among features.
  • Modeling benign relationships: For each feature with neighbors, a ridge regressor predicts its benign value from neighboring features, while residual scales capture typical prediction error.
  • Dependency-violation scoring: At inference, normalized residual magnitudes quantify relationship violations, and a relationship is broken when its score exceeds threshold τ.
  • Anomaly detection: An instance raises an alert when at least k simultaneous dependency violations occur; this work sets k = 2 to reduce spurious detections from isolated fluctuations.
  • Post-alert analysis: Post-alert analysis examines the temporal order in which feature relationships break during attacks.

5 Experiments and Evaluation Strategy

The evaluation uses two IDS datasets, standardized numerical flow features, unsupervised splits, dependency modeling, statistical tests, and Isolation Forest as a lightweight baseline. It examines whether dependency violations distinguish attacks from benign traffic while considering efficiency and interpretability.

  • Pre-processing: Both datasets use a common 79-dimensional numerical feature space after excluding five non-feature fields from the raw CICFlowMeter columns.The excluded fields are Flow ID, source and destination IPs, timestamp, and label.
  • Experimental design: Benign data are split into training, validation, and test roles for learning models, configuring detectors, and final evaluation with attack samples.Malicious samples are retained without artificial balancing or subsampling to preserve temporal distributions.
  • Dependency modeling: The dependency model uses sparse feature relationships and local predictive models, whose goodness of fit is measured with R2.The evaluation also measures the time required to learn the dependency graph and fit the local models.
  • Evaluation measures: Dependency-violation distributions are compared between benign and attack traffic using Mann–Whitney U and Kolmogorov–Smirnov tests.The analysis considers mean violation score vmean and median violated-feature count nviol, with τ calibrated on held-out benign validation data.
  • Baseline and scope: Isolation Forest provides the lightweight unsupervised ML baseline, with its alert threshold selected at the 90th percentile of benign validation scores.The study does not aim to build a perfect anomaly detector, but to assess dependency violations and their relation to an independent ML detector.

6 Results

The learned dependency models fit benign data strongly, and attacks produce broader and larger dependency violations than benign traffic. Detection signals are broadly comparable to Isolation Forest, while post-alert analysis exposes attack-specific temporal and structural disruption patterns.

  • Dependency model: Median local-predictor R2 is 0.99 in both datasets, indicating accurate prediction of many benign feature values from neighboring features.The learned graphs include neighbors for 69 features in CIC-IDS-2018 and 70 in CIC-UNSW-NB15.
  • Dependency model: 48.85 seconds and 76.51 seconds are required to learn the dependency graph and fit local predictive models for CIC-IDS-2018 and CIC-UNSW-NB15, respectively.The larger benign sample count in CIC-UNSW-NB15 does not produce a proportional runtime increase.
  • Violation distributions: Attack traffic consistently exhibits larger dependency violations than benign traffic, with all Mann–Whitney U tests yielding p < 0.01.High KS values also indicate distributional changes in variability and tails, while nviol suggests simultaneous violations across multiple dependencies.
  • Detection performance: The dependency-based detector achieves high recall across most attack categories, while Isolation Forest is more variable, especially for Reconnaissance in CIC-UNSW-NB15.The two detectors show broadly comparable discrimination on CIC-IDS-2018, whereas the dependency-based detector has higher AUROC and AUPRC on CIC-UNSW-NB15.
  • Detection performance: Performance is relatively stable across parameter configurations on CIC-UNSW-NB15 but more sensitive to τ and k on CIC-IDS-2018, particularly for SSH brute force.The reported detection metrics primarily serve as a sanity check and comparison with the ML baseline.
  • Temporal comparison: Dependency-violation and Isolation Forest signals show broadly similar temporal patterns, but dependency violations can remain informative when IF variability or anomaly scores are less pronounced.Reconnaissance produces persistent dependency-violation signals, while exploit signals are smoother than IF peaks.
  • Post-alert analysis: Attack-specific violations reveal distinct disruption patterns: widespread early DDoS HTTP violations, progressive Slowloris violations, localized early SSH brute-force violations, and predominantly early disruptions in DoS, exploits, and reconnaissance.Affected relationships commonly involve traffic volume, packet lengths, throughput, interarrival times, and multiple connected neighbors.

7 Discussion

XION’s dependency violations distinguish attack traffic from benign traffic and expose temporal and structural disruption patterns, while matching IF-like detection with lower inference time. The evaluation also identifies dataset and feature-representation limits that constrain transfer to operational networks.

  • Dependency-violation signals: Attack traffic systematically produces larger dependency violations than benign traffic across all evaluated scenarios.The differences are statistically significant according to Mann–Whitney U tests.
  • Dependency-violation signals: DDoS HTTP, DoS, Exploits, and Reconnaissance produce the most widespread disruptions, with high distributional separation and many violated relationships per flow.These patterns are consistent with attacks that substantially alter traffic composition or flow dynamics.
  • Temporal attack patterns: Slowloris shows strong but temporally variable violations that emerge progressively, reflecting a stealthier low-rate denial-of-service pattern.Violations continue to emerge during the middle and later stages of the attack timeline.
  • Detection comparison: The dependency-based detector produces anomaly signals and alert timing that closely overlap with IF, reacting at the first malicious dataset flow.Its balanced accuracy is comparable to IF across most scenarios, though it generally has higher false-positive rates.
  • Efficiency: 18?
  • Efficiency: 18XION has lower inference times than IF across all evaluated attack scenarios, and complete graph learning plus local-model fitting takes less than two minutes on both datasets.
  • Post-alert analysis: Dependency violations support post-alert investigation by prioritizing features and relationships according to temporal position and semantic role.This interaction-level view is unavailable from aggregate anomaly scores alone and can assist alert triage.
  • Attack-specific patterns: SSH brute-force attacks create localized, weakly propagating violations, whereas Exploits and Reconnaissance generate synchronized violations soon after onset.Reconnaissance affects fewer features than Exploits while retaining a similar overall temporal structure.

8 Conclusion

The conclusion presents XION as a benign-only dependency model that detects attacks through broken feature relationships and provides structural, temporal interpretability. Results support its complementary use in network monitoring, while controlled validation and robustness under changing traffic remain open directions.

  • Conclusion: XION learns conditional dependencies from benign flow traffic and detects attacks through violations of expected feature relationships.
  • Conclusion: Across CIC-IDS-2018 and CIC-UNSW-NB15, dependency violations emerge consistently during attacks and produce anomaly signals comparable to IF.
  • Conclusion: XION captures attack-specific disruption patterns ranging from synchronized violations in large-scale attacks to localized or progressively evolving violations in stealthier scenarios.
  • Conclusion: XION reveals which relationships break, when they break, and how violations propagate across the learned dependency structure.
  • Conclusion: The findings suggest dependency modeling can complement network-monitoring tools by providing structural insight without explicit causal models or domain-specific rules.
  • Future validation: Controlled testbeds with known anomaly causes would enable more rigorous validation of XION’s interpretability and diagnostic capabilities.
  • Future work: Future work will examine dependency violations across multi-step attack chains and their transition points.
  • Future work: Robustness under concept drift remains an open issue because benign feature relationships may change over time.

A Learned Dependency Graphs

Figure 4 presents small, intelligibility-focused subsets of the learned dependency graphs for the two CIC datasets, retaining only their strongest relationships.

  • Learned dependency graphs: Figure 4 shows two small graph subsets, one for CIC-IDS-2018 and one for CIC-UNSW-NB15.
  • Learned dependency graphs: Only the strongest relationships are included in both graphs to improve intelligibility.

B Sensitivity Analysis

Table 6 summarizes how the DP-based detector responds to neighboring values of the selected thresholds.

  • Sensitivity analysis: Table 6 reports a sensitivity analysis of the DP-based detector under neighboring selected-threshold values.

C ROC and Precision–Recall Analysis

The section compares threshold-independent detection performance for DP and IF using AUROC and AUPRC, with ROC and precision–recall curves shown for two IDS datasets. It also reports detector sensitivity to τ and k.

  • Table 7 reports AUROC and AUPRC for DP and IF across all attack scenarios.Higher values indicate better discrimination across decision thresholds.
  • An AUROC of 0.5 corresponds to random ranking, while the baseline AUPRC depends on the evaluated attack prevalence.
  • Figures 5 and 6 show ROC and precision–recall curves for DP and IF on CIC-IDS-2018 and CIC-UNSW-NB15, respectively.The dashed horizontal line in each precision–recall plot marks the no-skill baseline based on attack prevalence.
  • Table 6 evaluates the dependency-based detector’s sensitivity to τ and k using benign-traffic FPR and attack-performance metrics.The reported metrics include recall, balanced accuracy, MCC, and attack-specific recall; bold marks the main-evaluation configuration.
Loading 2608.26831v1…