When Relationships Break: Interpreting Network Traffic Anomalies via Dependency Violations

• URL: http://arxiv.org/abs/2608.26831v1
• Date: Thu, 27 Aug 2026 09:05:09 GMT
• Title: When Relationships Break: Interpreting Network Traffic Anomalies via Dependency Violations
• Abstract summary: XION is a method for modeling relationships among network-flow features based on benign traffic only.<n>During detection, anomalies are identified through violations of expected feature dependencies.<n>XION supports post-alert analysis by identifying which feature relationships break.
• Score: 2.406359246841227
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Current research on security monitoring is increasingly focusing on machine-learning-based approaches, but caveats remain. In addition to huge computational overhead, one concern is the lack of insights into "why" alerts are raised. Existing interpretability approaches rely on feature attribution methods that ignore dependencies among features or on causal modeling that requires extensive domain knowledge or computational resources. This work proposes XION, a method for modeling relationships among network-flow features based on benign traffic only. During detection, anomalies are identified through violations of expected feature dependencies. Further, XION supports post-alert analysis by identifying which feature relationships break, when they break along the attack timeline, and how dependency violations evolve relatively to other identified violations. XION is evaluated on standard IDS datasets and compared against an Isolation Forest (IF) baseline across multiple attack scenarios, including both volumetric and stealthier attacks. Results show that XION matches or exceeds IF recall in all evaluated scenarios, while requiring up to 7x less inference time. At the post-alert stage, the dependency-violation analysis reveals temporal and structural patterns consistent with known attack behaviors, which IF alone could not contribute to. Together, these findings confirm that attacks indeed disrupt feature dependencies learned from benign traffic, and that these disruptions provide additional information for understanding an alert.

Related papers

• Towards Anomaly Detection on Relational Data [51.473064583839296]
  We propose a reconstruction-based framework that captures anomalies from both attribute and relational edge reconstruction.<n>RelAD consistently outperforms other baselines while achieving competitive efficiency.
  arXiv  Detail & Related papers  (2026-06-17T02:36:32Z)
• Causal Ensemble Agent: Hierarchical Causal Discovery with LLM-guided Expert Reweighting [95.24017293537025]
  Causal Ensemble Agent (CEA) is a novel framework that aggregates structural insights from statistical discovery experts across different graph levels.<n>CEA achieves the strongest overall performance across a wide range of causal discovery methods.
  arXiv  Detail & Related papers  (2026-06-09T09:09:07Z)
• FlowGuard: Flow Matching for Identity-Independent Detection of Data-Free Model Stealing Attacks on Energy System Intrusion Detection Systems [0.0]
  FlowGuard is an identity-independent defence based on flow matching that classifies incoming queries as out-of-distribution (OOD)<n>This approach exploits the fact that queries generated synthetically for data-free model stealing attacks occupy a lower-dimensional manifold than real network traffic.<n>We evaluate our method against PRADA and FDINet using MAZE and DisGUIDE attacks in single-client and distributed (100-client Sybil) settings.
  arXiv  Detail & Related papers  (2026-06-02T10:18:45Z)
• On the Privacy of LLMs: An Ablation Study [0.0]
  Large language models (LLMs) are increasingly deployed in interactive and retrieval-augmented settings.<n>We introduce a unified threat model and notation, reproduce a representative set of privacy attacks, and conduct a structured ablation study.
  arXiv  Detail & Related papers  (2026-05-04T06:06:41Z)
• TFLAG:Towards Practical APT Detection via Deviation-Aware Learning on Temporal Provenance Graph [7.676383564795898]
  Advanced Persistent Threat (APT) have grown increasingly complex and concealed.<n>Recent studies have incorporated graph learning techniques to extract detailed information from provenance graphs.<n>We introduce TFLAG, an advanced anomaly detection framework.
  arXiv  Detail & Related papers  (2025-01-13T01:08:06Z)
• Pattern-Based Time-Series Risk Scoring for Anomaly Detection and Alert Filtering -- A Predictive Maintenance Case Study [3.508168174653255]
  We propose a fast and efficient approach to anomaly detection and alert filtering based on sequential pattern similarities. We show how this approach can be leveraged for a variety of purposes involving anomaly detection on a large scale real-world industrial system.
  arXiv  Detail & Related papers  (2024-05-24T20:27:45Z)
• On the Identification of Temporally Causal Representation with Instantaneous Dependence [50.14432597910128]
  Temporally causal representation learning aims to identify the latent causal process from time series observations. Most methods require the assumption that the latent causal processes do not have instantaneous relations. We propose an textbfIDentification framework for instantanetextbfOus textbfLatent dynamics.
  arXiv  Detail & Related papers  (2024-05-24T08:08:05Z)
• A Hierarchical Security Events Correlation Model for Real-time Cyber Threat Detection and Response [0.0]
  We develop a novel hierarchical event correlation model that promises to reduce the number of alerts issued by an Intrusion Detection System.<n>The proposed model takes the best of features from similarity and graph-based correlation techniques to deliver an ensemble capability not possible by either approach separately.<n>The model is implemented as a proof of concept with experiments run on the DARPA 99 Intrusion detection set.
  arXiv  Detail & Related papers  (2023-12-02T20:07:40Z)
• Stateful Offline Contextual Policy Evaluation and Learning [88.9134799076718]
  We study off-policy evaluation and learning from sequential data. We formalize the relevant causal structure of problems such as dynamic personalized pricing. We show improved out-of-sample policy performance in this class of relevant problems.
  arXiv  Detail & Related papers  (2021-10-19T16:15:56Z)
• Disentangling Observed Causal Effects from Latent Confounders using Method of Moments [67.27068846108047]
  We provide guarantees on identifiability and learnability under mild assumptions. We develop efficient algorithms based on coupled tensor decomposition with linear constraints to obtain scalable and guaranteed solutions.
  arXiv  Detail & Related papers  (2021-01-17T07:48:45Z)
• Learning Causal Models Online [103.87959747047158]
  Predictive models can rely on spurious correlations in the data for making predictions. One solution for achieving strong generalization is to incorporate causal structures in the models. We propose an online algorithm that continually detects and removes spurious features.
  arXiv  Detail & Related papers  (2020-06-12T20:49:20Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.