How Diffusion Models Can Explain and Stop Cyber Attacks?

Network intrusion detection systems (NIDS) rely on deep neural networks to spot cyber attacks. Yet, these models often act as "black boxes": they output a decision without explaining why. Without transparency, it’s hard to react quickly and apply effective countermeasures.

The study introduces an innovative solution: diffusion‑based tabular counterfactual explanations. The method creates alternative network data points that would have led to a different classification, highlighting which features triggered the attack alert.

Researchers evaluated the algorithm on three modern intrusion datasets, comparing it with existing counterfactual methods. Results show the new approach yields more plausible, diverse explanations in less time. Moreover, the explanations can be condensed into global rules – simple "if‑then" statements that swiftly filter suspicious requests. These rules turn technical insights into concrete defensive actions.

The code is publicly available on GitHub, inviting the community to enhance NIDS transparency. In the future, such techniques could make cyber defenses smarter and more responsive, narrowing the gap between detection and response.

Diffusion models, originally devised for image generation, have been adapted to tabular data via a forward‑reverse process. In the forward phase, original data are gradually perturbed by adding Gaussian noise; in the reverse phase, a learned neural network reconstructs the data step‑by‑step, guided by a target condition (e.g., the "normal" class). To generate counterfactuals, one starts from an attacked sample and steers the reverse diffusion toward the space of observations classified as "normal," while enforcing plausibility constraints (e.g., values within realistic ranges).

The advantage over gradient‑based methods lies in exploring non‑linear paths on the data manifold, avoiding artefactual or out‑of‑distribution solutions. Moreover, explanation diversity is ensured by the stochastic nature of the injected noise, producing multiple reconstruction trajectories.

In NIDS contexts, global rules extracted from counterfactuals can be formalized using rule‑learning algorithms (e.g., RIPPER or CART). These rules distill the most influential features (such as ports, protocols, or TCP flags) into logical conditions easily implementable in firewalls or intrusion prevention systems (IPS). Evaluation on datasets like CIC‑IDS2017, UNSW‑NB15, and NSL‑KDD showed a 30‑40% reduction in average generation time compared to GAN‑ or VAE‑based methods, while maintaining explanation accuracy above 85%.

Finally, the open‑source release on GitHub under an MIT license promotes reproducibility and extension of the framework, allowing researchers and practitioners to embed counterfactual explanations into their operational security pipelines.