# Combining Unsupervised Approaches for Near Real-Time Network Traffic Anomaly Detection
## 4 Experiment
### Explainable Artificial Intelligence with SHAP
In this case, the deduced information is also consistent with the definition of Euclidean distance; if the calculated Euclidean distance between a sample given as input and the reconstructed sample of the autoencoder network has a high value, it implies that the autoencoder network was not able to reconstruct the sample given as input. If the autoencoder network cannot reconstruct a sample, the analyzed data are probably very different from the data in the training dataset, so it can be considered an anomalous sample. A bar graph is shown in Figure 3 that clearly shows the influence that each feature has on the prediction model. In particular, on the abscissa axis are reported, in ascending order, the 15 most influential features, while on the ordinate axis is reported the average value of SHAP for each feature of the analyzed dataset. From Figure 3, it is possible to observe that among the first 15 features with a higher average SHAP value are the features euclidean distance, cosine similarity and some features related to the compressed sample Zc. Therefore, it is possible to state that the new  
Figure 3: Bar graph of SHAP values calculated for the KDDCUP99 dataset using the EIF model of the MemAE-EIF algorithm. features calculated by the MemAE-EIF model affect the prediction process of the anomaly score. As seen for the KDDCUP99 dataset, it is possible to analyze the SHAP values calculated for the NSL-KDD dataset features using the MemAE-EIF algorithm. The dataset used to test the algorithm contains 46% anomalous samples, and the remaining 54% are samples describing normal traffic. For the NSL-KDD dataset, the records used for the training and prediction phases of the EIF model related to the MemAE-EIF algorithm consist of 43 features. The MemAE-EIF algorithm and the features in the NSL-KDD dataset generate new features for each sample. Figure 4 shows a graph describing the SHAP values computed for the features of the NSL-KDD dataset using the EIF model of the MemAE-EIF algorithm. From the graph in Figure 4, it can be observed that the features introduced in the MemAE-EIF algorithm do not rank among the top 15 most influential features. However, 3 of the 6 features introduced by the proposed algorithm rank among the top 25 most influential features: in detail, the features of the Zc1 Zc2 and Zc3 tablet representation rank at position 25, 30, and 19, respectively, whereas the cosine similarity measure and the Euclidean distance rank at position 31 and 24, respectively. From the SHAP analysis of the 43 features used to train the EIF model of the MemAE-EIF algorithm, it is observed that the introduced features affect the prediction process of the anomaly score. Figure 5 shows a bar graph displaying the influence of each feature in an analogous way to what was conducted for the KDDCUP99 dataset. Figure 4: Summary plot of SHAP values calculated for the NSL-KDD dataset using the EIF model of the MemAE-EIF algorithm  
As performed for the other two datasets, it is possible to analyze the SHAP values calculated for the features in the CIC-IDS2017 dataset using the MemAE-EIF algorithm. The dataset used to test the algorithm contains 20% anomalous samples, and the remaining 80% are samples describing normal traffic. The records used for both the training and prediction phase of the EIF model related to the MemAE-EIF algorithm consist of 83 features. Figure 6 shows the graph describing the SHAP values calculated for the features in the CIC-IDS2017 dataset using the EIF algorithm of the MemAE-EIF model. Looking at Figure 6, it can be seen that the features introduced in the MemAE-EIF algorithm do not rank among the top 15 most influential features. However, four of the five features introduced by the proposed algorithm rank among the top half of the most influential features. Specifically, the compressed representation features Zc1 Zc2, and Zc3 rank at positions 32, 61, and 28, respectively, while the cosine similarity measure and Euclidean distance rank at positions 41 and 30, respectively.