 |
We have shown an explainable flow-data classification model for hacker¡¯s attacks and malwares. The flow data used for training the model were converted from packets by CICFlowMeter. This process greatly shrank the size of data which reduced the requirement for data storage. We then introduced CSTITool to feature extraction processes with an aim of improving the model performance. We compared the XGBoost models that were trained with features obtained by CICFlowMeter and CSTITool. The result showed that the additional descriptive flow statistics created by CSTITool can help improve the performance metrics. In order to understand how the model made predictions, we used SHAP to further investigate the relation between cyberattacks and network flow features. The experiences showed that our model achieved good accuracy in both hacker¡¯s attack and malware classification. It provided interpretability in hacker¡¯s attacks. However, there is still no sufficient theoretical explanation for the causal relationship between the features and the malwares, and further research is needed.
|
IEEE/ICACT20220024 Slide.16
[Big Slide]