[1F2-GS-10a] AI応用：ネットワーク

[1F2-GS-10a-05] A Study of Improving Interpretability of Deep Learning Anomaly Detection using Network Payloads

〇Tomohiro Nagai¹, Yasuhiro Teramoto¹, Masanori Yamada¹, Yuuki Yamanaka¹, Tomokatsu Takahashi¹ (1. NTT Secure Platform Laboratories)

Keywords:Machine learning, security, explainability

The threat posed by unknown cyber attacks requires detection of intrusions and incident response, as the cyber attack may cause physical damage in Smart Factory. Recently, malicious attacks have rewritten parts of the payload to mimic normal payloads.Much recent research focuses on deep learning based anomaly detection. However, previous work on anomaly detection have not focused on the presentation for explainable decisions. In this paper, we propose methods for explanation of anomaly detection using decisiton tree. We evaluated using a dataset obtained on a factory simulator to demonstrate its ability to present the anomaly bytes of cyber attacks.