# Investigation of Phishing Susceptibility with Explainable Artificial Intelligence
## 4 Results and Discussion
### SHAP Explanation  
Figure 3 below illustrates the impact of different factors on phishing susceptibility as revealed by the SHAP XAI method. The behavioral habits-related factors have the largest impact on phishing behavior. Interestingly, the checkhttps factor has the largest variability in terms of Shapley values. It is observed that individuals who seldom check for secure websites are assigned large positive Shapley values, which increases their probability of being phished. Conversely, high values of checkhttps may have a moderate impact on reducing the probability of being phished. On the other hand, the clickwocheck factor has exactly the opposite impact. Higher values of clickwocheck correspond to individuals who always click email links without checking their legitimacy and are assigned large positive Shapley values, which increases their probability of being phished. Lower values of chickwocheck lead to a decrease in the probability of being phished. Similar interpretations apply to other behavior-related factors  
Figure 3: SHAP Values for Features: In this plot, each data point represents an observation in the dataset. Features are displayed along the \(y\)-axis, and the \(x\)-axis represents the corresponding SHAP values. The color bar on the right serves as a reference, with red indicating high feature values and blue indicating low values. For instance, focusing on the “checkhttps” feature, instances with higher “checkhttps” values (depicted in red) exhibit negative SHAP values, ranging between \(-0.2\) and \(0\). This observation aligns seamlessly with our intuitive understanding. \begin{table}
\begin{tabular}{c c} \hline \hline
**Evaluation Metric** & **Value** \\ \hline Accuracy & 0.78 \\ Precision & 0.57 \\ Recall & 0.71 \\ F-1 Score & 0.64 \\ True Positive Rate & 0.75 \\ True Negative Rate & 0.79 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Model Performance. such as checklink and privacysetting. These findings align with established behavioral theories in cybersecurity, suggesting that individuals with greater technical knowledge and security awareness are less vulnerable [53; 54]. It is noteworthy that these results are inconsistent with a previous study based on the same data set [10], which did not identify any behavior-related factors having a significant impact on phishing susceptibility. This is possibly due to the fact that the previous study relied on stepwise logistic regression, which is a linear method and cannot capture nonlinear relationships between behavioral factors and phishing susceptibility. In contrast to the previous study, the current study used a deep neural network model to predict phishing susceptibility and then applied SHAP as a post-hoc method to identify important features. This approach is able to model the complicated nonlinear relationship between behavioral factors and phishing susceptibility. To provide evidence for our hypothesis regarding the nonlinear relationship between phishing susceptibility and behavioral factors, we then present some partial dependence plots for these features. Partial dependence plots are a type of visualization tool used in the SHAP method of model interpretation. It shows the marginal effect one or two features have on the predicted outcome of a machine learning model by fixing the values of all other features and varying the values of one or two features of interest. Thus, partial dependence plots provide an estimate of how the predicted outcome of a model changes as a function of one or two features and enables us to explore and visualize the relationships between input features and model predictions and can help identify non-linear relationships between features and target variables that may not be apparent in simple scatterplots or correlation matrices. Figure 4 depicts partial dependence plots for four variables: checkhttps (a), check-link (b), clickwocheck (c), and stress (d), respectively. The above plots illustrate the relationship between each variable and the probability of clicking on a phishing email.