# Cybersecurity Knowledge Extraction Using XAI
## 3 Results
### SHAP Summary Plot  
Although the SHAP feature importance plot is very useful, it contains no information other than the feature importance. To conduct a more detailed analysis, SHAP summary plots for each class must be examined (see Figure 4). The SHAP summary plot provides a thorough explanation of a model that incorporates feature importance (note that the features are sorted by importance for each class) and feature effect. Each instance has a single dot on each row. The dot's x position represents the feature's influence on the model's prediction for the instance, and the dot's color represents the feature's value for the instance. To demonstrate density, dots that do not fit on the row pile up. The x-axis is expressed in log odds.  
By examining the _Destination Port_ feature on Figure 4a, one can conclude that benign traffic is distinguished by high values of that feature. It is worth noting that data instances with low _Destination Port_ values might also be categorized as benign traffic. In this case, additional analyses are required since low values of the _Destination Port_ feature are more typical for another class, which will be explained in the rest of the paper (see _dependence plot_ section). When analyzing Figure 4b, one can notice that low values of the _Destination Port_ feature are highly indicative of a DoS attack. What can be argued with even greater certainty when analyzing Figure 4b is that when the _Destination Port_ feature takes on high values, it is most often not a DoS attack.  
The analysis of the _Destination Port_ feature of the summary plots for the DDoS class (see Figure 4c) and the port scan class (see Figure 4d) yield similar conclusions. When the value of the _Destination Port_ feature is low, we are less likely to claim that it is a DDoS attack instead of a DoS attack (notice the amount of blue on the graph's left side in Figure 4c). By examining the _Destination Port_ feature in Figure 4e, it is important to notice that low values of the _Destination Port_ feature are also indicative of brute force attacks, but further investigation is required since low values of this attribute are also indicative of another class. It is important to note that although we only covered the _Destination Port_ feature in the study, other features are also displayed in the plots to ensure thorough analysis.  
Some of the conclusions we reached by analyzing the SHAP summary plots can also be reached by examining the decision tree's if-then rules. In particular, the decision tree can be used to determine which spectrum of values of a given feature is typical for a given class. In fact, the decision tree can provide a much more detailed understanding of the above. Using the if-then rules, it is possible to create more granular feature intervals while the SHAP summary plot \"cuts\" the samples into two intervals (low, and high feature values). Regardless of the foregoing, the analysis of if-then rules is both demanding and exhaustive  
Figure 3: SHAP feature importance plot.  
if the tree depth is large. There are numerous if-then rules, and the same features and separation criteria can be repeated multiple times at various depths in the decision tree. What can be seen in the SHAP summary plots but not in the decision tree's if-then rules is how much each feature influences the prediction.