This study experimentally analyzes how the design of preprocessing structures for network traffic data influences the explanation quality of artificial intelligence models. Unlike previous studies that focused on improving detection accuracy or architectural complexity, this work demonstrates that even under identical training conditions, differences in input preprocessing strategies can lead to significant variations in model explainability. To this end, four preprocessing-based input structures were compared: (1) tabular inputs based on session features, (2) payload-only inputs using unstructured text, (3) a simple hybrid combination of tabular and payload inputs, and (4) a rule-based natural language structure that integrates rule-transformed tabular features with payload data. All models were trained on the same dataset under identical configurations, with detection performance evaluated using AUROC and F1-score, and explanation quality assessed through Comprehensiveness, Sufficiency, and Deletion–Insertion AUC. Experimental results show that detection performance remained similar across all four structures, but the rule-based model consistently achieved the highest explanation quality across all metrics. In particular, Integrated Gradients analysis revealed the formation of clear semantic cross-references between indicator expressions in the rule sentences and attack cues in the payload, indicating that the model effectively learned to integrate behavioral context and content evidence. These findings demonstrate that the design of network preprocessing structures is a key factor determining model interpretability and explanation fidelity, and emphasize the importance of data representation–oriented approaches for advancing toward explainable and trustworthy security AI systems.
Son et al. (Thu,) studied this question.