A Study of Improving Interpretability of Deep Learning Anomaly Detection using Network Payloads

Abstract

The threat posed by unknown cyber attacks requires detection of intrusions and incident response, as the cyber attack may cause physical damage in Smart Factory. Recently, malicious attacks have rewritten parts of the payload to mimic normal payloads.Much recent research focuses on deep learning based anomaly detection. However, previous work on anomaly detection have not focused on the presentation for explainable decisions. In this paper, we propose methods for explanation of anomaly detection using decisiton tree. We evaluated using a dataset obtained on a factory simulator to demonstrate its ability to present the anomaly bytes of cyber attacks.