ICACT20220024 Question.
Questioner: nishat.mowla@ri.se 2022-02-15 오전 3:04:12 |
ICACT20220024 Answer.
Answer by Auhor bojsahsupeng@iii.org.tw 2022-02-15 오전 3:04:12
Chrome  Click!! |
| Have you considered comparing your obtained results with other explainable AI techniques such as LIME, counterfactual explanation? |
|
ICACT20220024 Question.1
Questioner: yongj@gsic.titech.ac.jp 2022-02-14 오후 3:28:28 |
ICACT20220024 Answer.1
Answer by Auhor bojsahsupeng@iii.org.tw 2022-02-14 오후 3:28:28
Chrome Click!! |
| In the proposed method, how the network traffic from a NAT-router can be distinguished from that of an individual end client?
|
CICFlowMeter only records the public IP of the router. Network traffic from the individual hosts of a same local network would be considered from a same IP. However, source IP is discarded from the datasets that are used for the model since it has no affect to the result of Malware/hacker's attack classification. |
ICACT20220024 Question.2
Questioner: tomayoon@ieee.org 2022-02-14 오후 3:11:19 |
ICACT20220024 Answer.2
Answer by Auhor bojsahsupeng@iii.org.tw 2022-02-14 오후 3:11:19
Chrome Click!! |
| First of all, thank you for the good research paper and presentation contents. I would like to know more about the research environment used in this study, and also in detail about the equipment & operating systems, development languages and software libraries you used. |
The experiments were conducted on a machine with Ubuntu 18.04.5, Intel Xeon Processor E5-2630, and 80 GB RAM. The development languages are Python and Java. Some of the important libraries are:
numpy==1.20.3
scipy==1.6.3
scapy==2.4.3
pytz==2021.1
pandas==1.2.2
scikit-learn==0.24.2
xgboost==1.2.1 |
ICACT20220024 Question.3
Questioner: dongjiewu@iii.org.tw 2022-02-15 오전 10:54:33 |
ICACT20220024 Answer.3
Answer by Auhor bojsahsupeng@iii.org.tw 2022-02-15 오전 10:54:33
Chrome Click!! |
| As mentioned in the paper, the network traffic flow generator CICFlowMeter is used to obtain 82 statistical network traffic features. What are the major differences between CICFlowMeter and CSTITool? Why did you choose the latter over the former in the experiments? |
CSTITool is a tool that we developed based on CICFlowMeter. We added more descriptive flow statistics in CSTITool so it can extract more (53) features than CICFlowMeter. For more detail please see reference[4], [10] and TABLE 1. |
ICACT20220024 Question.5
Questioner: zakaria.sawado@gmail.com 2022-02-15 오전 11:44:44 |
ICACT20220024 Answer.5
Answer by Auhor bojsahsupeng@iii.org.tw 2022-02-15 오전 11:44:44
Chrome Click!! |
| you say that Precision and Recall are close to 1 regardless of the predicted category. But don't you situate your work in relation to the work already done or is your work the first in the field? What is the particularity of your approach compared to the existing ones?
|
The model itself is indeed not the first, and our contribution is the feature engineering/extraction of Network flow feature. We have not seen other related papers or tools propose similar feature extraction. Also, it is the first paper that uses SHAP in this area. |
ICACT20220024 Question.6
Questioner: mryoulin@gmail.com 2022-02-17 오전 11:57:37 |
ICACT20220024 Answer.6
Answer by Auhor bojsahsupeng@iii.org.tw 2022-02-17 오전 11:57:37
Chrome Click!! |
| I cannot find how your CSTITool has been developed form the CICFlowMeter in your paper, Could you give a description about it ?
|
In a nutshell, after studying the characteristics of different malware, features that are associated with the malware are added to CICFlowMeter. We also modified the way CICFlowMeter converting packets into network flow, e.g., turning a single packet into a network flow. These adjustments are applied to CICFlowmMeter according to malware used in the following experiments. For more detail please refer to reference[4], [10]. |
ICACT20220024 Question.7
Questioner: nishat.mowla@ri.se 2022-02-18 오후 4:36:32 |
ICACT20220024 Answer.7
Answer by Auhor bojsahsupeng@iii.org.tw 2022-02-18 오후 4:36:32
Chrome Click!! |
| Have you considered comparing your obtained results with other explainable AI techniques such as LIME, counterfactual explanation? |
Thank you for the question. LIME is a great technique. However we used SHAP because its results provide an easy-to-read global and local view of the model predictions, while LIME only offers local interpretations. SHAP also has several advantages that LIME is lacking. But without comparing the results of these two methods we can't say which one is better. We will consider put it into our future work. Thank you! |
