 |
To further understand how each individual feature affects the classification, in other words, to understand the relation between the magnitude of a certain feature and the impact on the prediction, we use SHAP beeswarm plot.
Figure a and Figure b show that an attack with small Fwd IAT Min value has a higher chance of being classified as Brute Force or Endpoint Denial of Service. IAT is the average interval time between two packets. As Brute Force and Endpoint Denial of Service are both types of attacks that attempt to connect to the target many times in a short period of time, they usually have a small Fwd IAT value.
By means of port scans and vulnerability scans, a hacker may attempt to get a listing of services running on the targeted hosts. CIC-IDS2017 records Network Service Scanning behaviours which adversaries utilized Nmap to implement Port Scan on the remote hosts. One of the port scan techniques supported by Nmap is Xmas scan, which sets the FIN, PSH, and URG flags. This may be responsible for the high PSH Flag Count in Network Service Scanning class.
Contrary to Brute Force and Endpoint Denial of Service, the connection frequency of Remote Access Software is lower, that is, the IAT value should be smaller. As a result, the larger the value of Bwd IAT Min and Fwd IAT Min, the higher chance it will be classified as Remote Access Software.
The beeswarm plot combines feature importance with feature effects, giving us preliminary understanding of the relationship between the value of a feature and the impact on the prediction. To display explanations for individual predictions, we can use SHAP force plot.
|
IEEE/ICACT20220024 Slide.13
[Big Slide]