ExplainabilitySafetySecuritycs.LG
Explainable Machine Learning for Cyberattack Identification from Traffic Flows
Yujing Zhou, Marc L. Jacquet, Robel Dawit, Skyler Fabre, Dev Sarawat, Faheem Khan, Madison Newell, Yongxin Liu, Dahai Liu, Hongyun Chen, Jian Wang, Huihui Wang
May 2, 2025
2025 IEEE Security and Privacy Workshops (SPW)
3 citations
Key Takeaways
-
Explainability is essential for catching AI mistakes in critical infrastructure: The researchers used Explainable AI techniques to diagnose why their cyberattack detection system made errors, revealing that mislabeled data during traffic recovery phases was misleading the model—a problem that wouldn't have been visible without interpretability tools.
-
Simple traffic metrics can reveal sophisticated attacks: The study found that just two observable measures—Longest Stop Duration and Total Jam Distance—were sufficient to detect when traffic signals had been compromised, suggesting that transportation agencies don't need access to complex network data to identify cyberattacks.
-
Current AI systems have blind spots in real-world conditions: The research identified a critical limitation: the detection system failed to catch "stealth attacks" during low-traffic periods, highlighting that AI-based security solutions require ongoing refinement and cannot be deployed as complete solutions without acknowledging their vulnerabilities.
-
Responsible AI deployment requires transparency about limitations: Rather than presenting their system as a finished product, the researchers explicitly documented two categories of failure modes (data inconsistencies and model limitations), demonstrating how responsible AI development should communicate what systems can and cannot do reliably.
Abstract
The increasing automation of traffic management systems has made them prime targets for cyberattacks, disrupting urban mobility and public safety. Traditional network-layer defenses are often inaccessible to transportation agencies, necessitating a machine learning-based approach that relies solely on traffic flow data. In this study, we simulate cyberattacks in a semi-realistic environment, using a virtualized traffic network to analyze disruption patterns. We develop a deep learning-based anomaly detection system, demonstrating that Longest Stop Duration and Total Jam Distance are key indicators of compromised signals. To enhance interpretability, we apply Explainable AI (XAI) techniques, identifying critical decision factors and diagnosing misclassification errors. Our analysis reveals two primary challenges: transitional data inconsistencies, where mislabeled recovery-phase traffic misleads the model, and model limitations, where stealth attacks in low-traffic conditions evade detection. This work enhances AI-driven traffic security, improving both detection accuracy and trustworthiness in smart transportation systems.
Paper Info
arXiv ID2505.01488
PublishedMay 2, 2025
Citations
3
Relevance75%
Venue2025 IEEE Security and Privacy Workshops (SPW)
TypeJournalArticle
Categorycs.LG
Responsible AI Topics
ExplainabilitySafetySecurity
Links
Citation data from Semantic Scholar