Explainable Network Anomaly Detection with GraphSAGE and SHAP
Ji‐Hoon Lee, Seungmin Oh, Jaeho Song, Juhyeon Noh, Minsoo Hanh, Jinsul Kim · 2025
Network anomaly detection is a critical task for maintaining network stability and security. However, existing models often focus solely on achieving high predictive performance, falling short in providing the interpretability and reliability needed for practical applications. To address this limitation, this study proposes a novel approach that combines GraphSAGE and SHAP. GraphSAGE is designed to classify various types of network anomalies effectively by leveraging network data, while SHAP extracts and quantifies the contributions of key features influencing the model's predictions. The experimental results demonstrate that the proposed model achieved high accuracy and Fl-score, successfully identifying the most significant features for each anomaly class. This study highlights that the integration of GraphSAGE and SHAP enhances the interpretability and practicality of network anomaly detection. By providing clear explanations for the model's predictions, this approach offers actionable insights for network administrators, making it a valuable tool for real-world network management and security applications.