XAI-Based Adaptive Feature Selection Method for Efficient Classification of Encrypted Malicious Traffic

As the number of devices connected to the network has increased exponentially, hyper-connected intelligent network environments have become common. As a result, as sensitive data transmission and reception become frequent on the network, encrypted traffic began to be actively studied for secure data communication. However, due to the nature of encrypted traffic, the number of cyber attackers bypassing detection systems, such as network intrusion detection systems (NIDS), and exploiting them to conceal attack behavior is on the rise. To address this, conventional detection methods—based on signal analysis, static and dynamic analysis, deep packet inspection (DPI), and artificial intelligence (AI)—are being studied. However, these methods face limitations in dealing with high-complexity mechanisms and are difficult to apply to zero-day attacks. In particular, AI-based detection methods, which have been extensively researched recently, suffer from low scalability and difficulties in explaining prediction results, making the reliability of the results uncertain. Therefore, this study proposes an enhanced principal component analysis (PCA)-based adaptive feature selection (AFS) technique to efficiently classify malicious encrypted traffic. AFS can strengthen detection performance by optimizing feature selection for learning and can demonstrate that the detection results for encrypted traffic are explainable, based on eXplainable AI (XAI).