 |
We have mentioned that the CSTI-10-B model is expected to achieve better performance than the CSTI-10-A model due to the extra features it uses. We sum the mean absolute Shapley values per feature across the data of each malware, and then sort the features by decreasing importance. We found that among the top 20 important features of these ten malwares, on average at least 7 are additional features that we added, which means that the additional features have a considerable contribution in identifying malware.
The data from Emotet and Rig have better improvement in performance, so we use them to plot SHAP beeswarm plot.
Time-related features such as Interarrival Time and Flow Time have a stronger impact on Emotet. For example, if the value of idle max or idle std is higher, the case is easier to be classified as Emotet. Cases with a low value of Flow IAT Min also tend to be labelled as Emotet. Besides, features related to Flow Descriptors and Flags are more influential to Rig class. For example, cases with a large Fwd Act Data Pkts, large Fwd Act Data Pkts, or low FIN Flag Count have a higher chance to be classified as Rig.
The SHAP tool provides an approach to understand the impact of the network flow features on the malware classification. However, much uncertainty still exists about the causal relationship between the features and the malwares. For example, although the idle and IAT related features are influential to Emotet class, and Flow Descriptors and Flags are important to classify Rig class, a theoretical explanation for their relation is still lacking. This indicates a need for further research on how the important features impact on each malware.
|
IEEE/ICACT20220024 Slide.15
[Big Slide]