 |
The experiments suggest that our models trained with network flow data are able to achieve good performance in both hacking and malware classification. However, in addition to the effectiveness, the users also expect transparency, interpretability and explainability of the model. Here we apply the open-source tool SHAP to achieve this goal.
We calculate SHAP value of all CIC-IDS2017 features that are used to construct hacker¡¯s attacks classification model. The features with the top 10 SHAP values are depicted in a bar chart. In this plot the impact of a network flow feature on 5 classes, Benign, T1046, T1110, T1219, T1499, are stacked to create the feature importance plot.
According to the bar chart, Destination Port is the most influential feature. It is also the most important feature for classifying Endpoint Denial of Service, Remote Access Software and Brute Force. Even though Destination Port is the most influential feature for the model, it is insignificant for Network Service Scanning. The second most important feature is Source Port, which is also the second most important feature that influences predicting Remote Access Software. We presume that Destination Port is influential to Remote Access Software due to the fact that this hacking technique is often implemented by a Botnet tool called ARES, which by default is executed by using port 8080. To support this presumption, we have to look at SHAP dependence plot, a scatter plot that illustrates the effect a single feature has on the predictions.
|
IEEE/ICACT20220024 Slide.11
[Big Slide]