Toward Intelligent Attack Detection with a Causal Explainable Method for Encrypting Traffic

To address the cybersecurity problems caused by encrypted traffic, current attack detection systems (ADSs) focus on non-decryption-based detection. However, non-decryption systems face problems including large training sample imbalances, which seriously affect ADS performance. To address these problems, we propose a structural causal model (SCM) for cyberattacks and define detection tasks such as eliminating noise features and providing interpretability. First, the influence of causal features on the results is enhanced by weighting the causal features, and low-weight noise features are removed to improve the causal interpretability of the detection results. Furthermore, samples are generated through a Wasserstein generative adversarial network (WGAN) that learns the causal feature distribution to balance the training samples. Finally, the detection performance is evaluated through the F1 score and interpretability indices. Our method achieves F1 score improvements on all datasets, and the causal relationships between cyberattacks and feature anomalies are explained through causal effects.