Network Data Formatting Shapes AI Explanation Quality

Published in Applied Network Science, the study provides empirical evidence that preprocessing design is not merely a technical step in data preparation but a fundamental determinant of how clearly a machine learning system can articulate the reasoning behind its security decisions. By isolating the impact of input representation from model architecture and training conditions, the team established that the structural choice of data encoding directly influences the fidelity and coherence of explainable AI outputs in network intrusion detection systems.

The investigation focused on a critical gap in cybersecurity research, where previous efforts have predominantly prioritized improving detection metrics such as accuracy and F1-scores while neglecting the interpretability of the underlying models. Traditional intrusion detection systems often rely on signature-based rules, which struggle to identify novel or evolving attack patterns, leading to the adoption of deep learning approaches that can analyze complex traffic structures. However, these advanced models frequently operate as black boxes, offering limited insight into which specific features or patterns drive a threat classification. This opacity creates significant challenges for security analysts who need to verify detection evidence and understand the causal factors behind an alert to ensure reliable threat response and operational security.

To address this, the researchers designed an experimental framework comparing four distinct preprocessing structures for network session data, all trained under identical conditions on the same dataset. The first structure used traditional tabular inputs based on session-level statistical features, such as packet counts and byte ratios. The second relied exclusively on unstructured payload text, decoding captured data into human-readable strings. The third was a hybrid model that combined tabular features with payload embeddings through a late-fusion mechanism. The fourth and most novel approach converted structured statistical features into rule-based natural language sentences, which were then integrated with the payload text in a unified linguistic space for early fusion.

The study utilized a custom session-based attack dataset generated in a controlled testbed environment between August and December 2024. This dataset comprised 1,843,420 sessions, including 85,904 normal sessions and 1,757,516 attack sessions across 23 distinct attack types. The attack scenarios covered the entire lifecycle of network threats, including Denial of Service attacks, web application vulnerabilities such as SQL injection and cross-site scripting, and authentication bypass attempts. By using a self-generated dataset, the researchers ensured that the data reflected recent malicious traffic patterns and preserved session-level temporal dependencies that are often lost in public benchmark datasets, which may not adequately capture modern multi-stage attack behaviors.

Detection performance was evaluated using weighted F1-scores to account for the class imbalance inherent in the dataset, while explanation quality was assessed using four rigorous metrics: Comprehensiveness, Sufficiency, Deletion AUC, and Insertion AUC. These metrics quantify the faithfulness of the explanations by measuring how prediction probabilities change when important inputs are removed or restored. The results showed that while the tabular model had a lower F1-score of 0.859, the Payload, Hybrid, and Rule-based models all achieved scores above 0.99. Statistical tests confirmed that the performance differences among the higher-performing models were negligible, establishing a control condition that allowed the researchers to attribute variations in explanation quality solely to the differences in input structure rather than model accuracy.

The Rule-based Tabular Transform plus Payload structure consistently achieved the highest explanation quality across all evaluated metrics. Its Comprehensiveness score was approximately 26% higher than the Hybrid model and 53% higher than the Payload-only model, indicating that the model relied more heavily on the identified important inputs. The Insertion AUC was also the highest, suggesting a faster recovery of prediction probability when key features were restored. These quantitative improvements were statistically significant, with effect sizes indicating that the input representation had a substantial impact on the clarity and reliability of the model’s attributions.

Visual analysis using Integrated Gradients revealed that the Rule-based model formed clear semantic cross-references between indicator expressions in the rule sentences and attack cues in the payload. For instance, the model linked rule-based indicators such as “many distinct destination ports” with payload evidence like “403 Forbidden” to infer a behavioral pattern of port scanning followed by failed authentication. In contrast, the Hybrid model showed weak interaction between structured and unstructured inputs due to its late-fusion architecture, while the Payload-only model lacked contextual consistency because it could not access behavioral statistics. This semantic alignment allowed the Rule-based model to express its decision-making basis in a human-understandable linguistic form, enhancing the practical utility of the explanations for security operations.

To validate the robustness of these findings, the team conducted external experiments on the CICIDS2017 dataset, specifically using the Web Attack subset from July 5, 2017. The preprocessing pipelines were applied without structural modification or dataset-specific retraining to isolate the effects of representation. While the absolute magnitudes of the explanation metrics varied due to differences in session granularity and payload availability, the relative behavioral differences between the preprocessing structures remained evident. The Rule-based structure continued to demonstrate greater stability compared to the Hybrid configuration, supporting the hypothesis that input representation design fundamentally shapes XAI dynamics even under heterogeneous data conditions.

The study highlights that preprocessing should be regarded as an XAI-aware representation design process rather than a preliminary data preparation step. By converting numerical features into linguistic descriptions, the Rule-based approach provides lexical context that guides the model’s attention toward meaningful semantic cues.

However, the researchers noted several limitations, including the constraint of the BERT model’s 512-token input length, which may truncate information in large sessions. The rule transformation mechanism also relies on expert-crafted templates, which may introduce domain bias and limit scalability across evolving attack scenarios. Future work will explore long-context language models and automated rule induction strategies to enhance the adaptability and practical applicability of these explainable AI systems in real-world network defense environments.

To transform raw packet captures into structured experimental inputs, the researchers engineered an extensive data processing pipeline centered on time-bounded sessioning. Packets sharing the same five-tuple combination of source IP, destination IP, source port, destination port, and protocol were grouped into fixed one-minute time windows. Within each interval, the team aggregated granular behavioral indicators, specifically tracking average inter-packet arrival times and destination port entropy to capture traffic irregularity. Application-layer communications were subsequently reconstructed using segment-ordered reassembly for TCP streams and ordered concatenation for UDP traffic. To convert raw bytes into coherent sequences, the authors implemented a protocol-aware decoding hierarchy. This system applied dedicated decoders based on port assignments to extract readable elements such as HTTP request methods, URIs, status codes, and DNS records. If port information was ambiguous, the pipeline inferred protocol identities by evaluating leading byte signatures and payload entropy, deploying ASCII decoding as a fallback for low-entropy payloads while flagging high-entropy segments as potential encryption.

To manage pronounced frequency disparities across the 24 classes, where SQL injection accounted for 41.4 percent of attack sessions while rare exploits like ActiveMQ deserialization yielded only 18 sessions, the team incorporated loss-function class weights and limited oversampling. Partitioning followed a stratified five-fold cross-validation scheme with an 8:1:1 train, validation, and test split based strictly on session identifiers. A pivotal innovation was the RuleTextifier component, which converted statistical session metrics into descriptive natural language sentences. Rather than simply listing extracted values, the module populated complete descriptive templates that incorporated explicit anomaly thresholds. For instance, when destination port entropy reached or exceeded 2.5, or when ten or more destination ports were touched, the module generated clauses highlighting elevated port diversity. Similar rules flagged packet arrival intervals under five milliseconds, the utilization of five or more source ports, or the complete absence of payload bytes. The RuleTextifier also returned a feature-token mapping dictionary, enabling gradient-based attribution frameworks to trace token importance back to original tabular features.

The underlying model architectures and evaluation protocols were strictly calibrated to ensure fair attribution comparisons. The tabular baseline relied on a three-layer multilayer perceptron trained with standardized inputs, rectified linear unit activations, batch normalization, and a dropout rate of 0.4. In contrast, the language-based architectures utilized a pre-trained bert-base-uncased backbone optimized with AdamW at a learning rate of 2e-5, processing tokenized sequences capped at 512 tokens. Gradient-based attributions were computed using 64 integration steps for Integrated Gradients and eight samples for GradientSHAP, measuring feature impact across top subsets of 10, 30, and 50 percent. When subjected to flow-level evaluation on the external CICIDS2017 benchmark, the hybrid model exhibited extreme instability, recording strongly negative Comprehensiveness (-10.255) and Sufficiency (-10.460) scores due to representational misalignment between fragmented tabular metrics and tokenized payloads. Conversely, the rule-integrated approach retained far greater attribution stability, pointing the way toward future research integrating time-series Transformers, Graph Neural Networks, and post-processed narrative explanations.

Subject of Research: The impact of network preprocessing structure design on XAI explanation quality in intrusion detection systems

Article Title: The impact of network preprocessing structure design on XAI explanation quality

Article References: Son, J., Cho, H., Hong, J., & Kim, Y. (2026). The impact of network preprocessing structure design on XAI explanation quality. Applied Network Science, 11(1), Article 37. https://doi.org/10.1007/s41109-026-00793-4

Image Credits: AI Generated

DOI: 10.1007/s41109-026-00793-4

Keywords: Explainable AI, Network Intrusion Detection, Data Preprocessing, BERT, Integrated Gradients, Cybersecurity, Rule-based NLP, Session-based Analysis, Feature Attribution, Model Interpretability, Traffic Analysis, Semantic Fusion, Threat Detection, Input Representation, GradientSHAP, Deletion-Insertion AUC, Comprehensiveness, Sufficiency, Sessionization, Payload Decoding