# Cybersecurity Knowledge Extraction Using XAI
## 3 Results
### SHAP Dependence Plot without Interaction Feature  
In order to obtain a more detailed insight into the relationship between a specific port and its impact on predictions, it is important to analyze the dependence plots. SHAP dependence plots depict the impact of a single feature on the entire dataset. They plot the value of a feature vs. its SHAP value across many samples. The vertical dispersion of SHAP values at a single feature value is driven by interaction effects, and another feature is chosen for coloring to highlight possible interactions. SHAP dependence plots (without interaction features) for the _Destination Port_ feature are shown on Figure 5. The figure only displays the ports from the interval [15, 85]. The three most popular ports in the data set, ports 21, 22, and 80, are intended to be included. The SHAP values of the _Destination Port_ feature for the values of features 21 and 22 for the benign class are extremely negative (see Figure 5a). This suggests that these destination port feature values are more likely to represent attacks than benign network activity. The figure also demonstrates that a very small proportion of data occurrences can nevertheless be benign (SHAP values are positive). The absolute value of these SHAP values is incredibly low, and only a tiny fraction of the data instances have such SHAP values (see the shade of blue). Without further analysis, it  
Figure 4: Summary plots. (**a**) Benign; (**b**) Dos; (**c**) DDos; (**d**) Port scan; (**e**) Brute force.  
is impossible to distinguish between benign traffic and an attack when the port takes the value 80 (see Figure 5a)--notice that there are both positive and negative SHAP values, and their absolute value is low. Similar to the benign class, if the _Destination Port_ feature takes the values 21 and 22, it is most likely not a DoS attack (see Figure 5b), nor a DDoS attack (see Figure 5c). When the port is 80, the situation is exactly the opposite. In this case, there is a high likelihood of a DoS or DDoS attack. If the port scan class is analyzed, one can once again conclude that the _Destination Port_ attribute does not carry much information (see Figure 5d). SHAP values oscillate around zero, and when the _Destination Port_ feature takes the value 21 or 22, it is impossible, without additional analysis, to determine whether it is a port scan class or another class. The port value of 80 is not typically associated with a port scan attack, though it is present in a small proportion of network instances that are classified as such. If the _Destination Port_ attribute takes the values 21 and 22, there is a high probability that it is a brute force attack (see Figure 5e). Namely, the SHAP values, in this case, are extremely positive. Port 80, on the other hand, is not typical for brute force attacks.  
Figure 5: Dependence plots. (**a**) Benign; (**b**) DoS; (**c**) DDoS; (**d**) Port scan; (**e**) Brute force.  
Conclusions drawn from analyzing SHAP dependence plots without interaction feature cannot be drawn from analyzing decision tree if-then rules. Specifically, the decision tree does not indicate how much the value of a particular feature contributes to the prediction. As previously stated, the if-then rule can be used to determine which value spectrum of a specific feature is characteristic of a specific class. However, analyzing a concrete value of a discrete feature is not always possible from the if-then rules of a decision tree. Note that it is possible for a decision tree to give rules for a specific value of a discrete feature. However, even if it does, it is quite challenging to locate and analyze each of these rules in a lengthy list of rules.