Model-Aware Visual Analytics for Aligning Data Shift in Network Traffic Classification

Deep learning (DL) models that excel on training data often underperform in deployment due to distribution shift, which is a change in the properties of the input data between the training environment and real-world conditions. Existing tools provide coarse drift scores but offer limited support for localization, interpretation, and remediation. Reliable classification is essential in the critical domain of network traffic, which is important for cybersecurity and network management. We present a human-centered visual analytics system for network traffic classification that integrates a DL classifier, post-hoc out-of-distribution (OOD) detection methods, and interactive analysis. Our approach systematically benchmarks OOD detectors, integrates the most effective one to a strong DL baseline, and embeds it into a dashboard that enables experts to explore drift phenomena, from global distributional changes down to individual packets. The visual-interactive system combines model-aware pr ojections, score distributions, class-level summaries, and local explainable artificial intelligence (XAI) to support drift localization and model interpretation. A qualitative evaluation shows how the system helps practitioners detect shifts, contextualize them with domain expertise, and plan corrective actions. By bridging automated detection with interactive exploration, our work advances more trustworthy and adaptive AI systems for dynamic network environments.