Explainability of Feature Relations in Malicious Network Data Based on Graph Attention Network

Abstract

Reinforcement learning-based intrusion detection systems achieve strong detection performance in unbalanced network traffic, but offer limited insight into which features have played a significant role in driving their decisions. To determine the key network features in detecting malicious packets, this paper presents a Graph Attention Network (GAT) model architecture applied to a feature dependency graph to analyze inter-feature influence in an RL-based intrusion detection system. Rather than ranking features independently, the framework uses GAT attention weights to reveal which feature relationships the model relies on most and how those relationships differ between malicious and benign traffic networks. Applied to a Rainbow DQN agent, a well-known RL-based agent, and trained on real botnet network traffic, the analysis identifies interpretable behavioral signatures in the feature influence structure that distinguish attack traffic from legitimate connections. The results demonstrate that attention-based influence analysis provides a richer characterization of detection decisions than per-feature importance methods alone.