Detection and Interpretation of Malicious Network Traffic via a Novel 8-Channel Image Representation

The increasing sophistication of cyber threats is driving a paradigm shift in malicious traffic detection from rule-driven approaches to artificial intelligence-powered solutions. Although existing deep learning (DL) methods have demonstrated notable success in this domain, their opaque decision-making processes significantly hinder practical implementation. Current DL-based detection systems for malicious encrypted traffic face dual challenges: limited compatibility with established explainable AI (XAI) frameworks and insufficient generation of actionable insights for cyber-security professionals. To address these critical limitations, this paper introduces an innovative 8-channel image representation for network traffic features. This multidimensional feature encoding not only enhances the detection capabilities of deep neural networks but also facilitates the adaptation of gradient-based XAI techniques to cyber-security applications. On the CICIDS2017 dataset, our method attains 99.10% accuracy on binary classification and 96.48% on multiclass tasks. We further quantify the importance of each feature and experimentally demonstrate the rationality of the contribution assessment. Finally, we analyze the limitations of existing fidelity metrics when faced with feature redundancy and interdependence. Our work presents a novel data-representation approach for DL classification and interpretation, advancing the integration of XAI with cyber-security and enhancing the reliability and transparency of network defense.