Interpretable deep learning method for attack detection based on spatial domain attention

Deep learning methods can directly extract effective features from original data. However, this type of model is complex and considered to be a 'black box', which leads to low interpretability of the models. Since the results of attack detection are significant to cybersecurity, every decision should be supported with convincing reasons. Hence, the problem of interpretability has become a bottleneck for deep learning methods applied to attack detection. We propose an interpretable deep learning method based on spatial domain attention. The model can discover and locate the feature strings in the packets, thereby providing a meaningful semantic explanation for the detection results. We conducted qualitative and quantitative experiments on the DARPA1998, UNSW-NB15, and CIC-IDS-2017 datasets. Experimental results show that the interpretability of our method is superior to the state-of-the-art interpretable models in quantifiable criteria, while maintaining comparable classification accuracy.