Search papers, labs, and topics across Lattice.
This paper introduces XION, a novel method for detecting network traffic anomalies by modeling feature dependencies derived from benign traffic. By identifying anomalies through violations of these dependencies, XION not only enhances detection capabilities but also facilitates post-alert analysis to understand the nature and evolution of these violations over time. Evaluated against an Isolation Forest baseline, XION demonstrates superior recall and significantly reduced inference time, revealing critical insights into attack behaviors that traditional methods overlook.
Anomalies in network traffic reveal critical dependency violations that can enhance detection and understanding of attacks, outperforming traditional methods with up to 7x faster inference.
Current research on security monitoring is increasingly focusing on machine-learning-based approaches, but caveats remain. In addition to huge computational overhead, one concern is the lack of insights into"why"alerts are raised. Existing interpretability approaches rely on feature attribution methods that ignore dependencies among features or on causal modeling that requires extensive domain knowledge or computational resources. This work proposes XION, a method for modeling relationships among network-flow features based on benign traffic only. During detection, anomalies are identified through violations of expected feature dependencies. Further, XION supports post-alert analysis by identifying which feature relationships break, when they break along the attack timeline, and how dependency violations evolve relatively to other identified violations. XION is evaluated on standard IDS datasets and compared against an Isolation Forest (IF) baseline across multiple attack scenarios, including both volumetric and stealthier attacks. Results show that XION matches or exceeds IF recall in all evaluated scenarios, while requiring up to 7x less inference time. At the post-alert stage, the dependency-violation analysis reveals temporal and structural patterns consistent with known attack behaviors, which IF alone could not contribute to. Together, these findings confirm that attacks indeed disrupt feature dependencies learned from benign traffic, and that these disruptions provide additional information for understanding an alert.
