# Combining Unsupervised Approaches for Near Real-Time Network Traffic Anomaly Detection
## 4 Experiment
### Explainable Artificial Intelligence with SHAP  
This section aims to analyze the importance of each feature in the anomaly score prediction process. To do this, the SHAP library [35; 36; 37] allows the estimation of the impact of each feature in the prediction process. SHAP values (Shapley Additive Explanations) represent an index that shows the contribution of a feature in driving the model output from the baseline value to the computed value. The features that push the prediction towards values greater than the base value will have a SHAP value that is proportionally positive and vice versa in the opposite case. Figure 2 shows a graph describing the SHAP values calculated for features in the KDDCUP99 dataset using the EIF model of the MemAE-EIF algorithm. Specifically, the y-axis presents, in descending order, the 15 features that most influence the predictive model, while on the x-axis are the SHAP values calculated for each feature of each sample analyzed. The dataset used to test the algorithm contains 20% anomalous samples, and the remaining 80% are samples describing regular traffic. The MemAE-EIF algorithm, in addition to the KDDCUP99 dataset features, generates three new features, namely:  
* \(Z_{\text{c}}\): Features of the compressed representation of the input sample. The autoencoder network of the MemAE algorithm compresses the input into a representation consisting of three characteristics indicated by [2c1, Zc2, Zc3];
* euclidean distance: Euclidean distance between the sample given as input and the sample reconstructed by the autoencoder network;
* cosine similarity: Cosine similarity between the sample given as input and the sample reconstructed by the autoencoder network. Figure 2: Summary plot of SHAP values calculated for the KDDCUP99 dataset using the EIF model of the MemAE-EIF algorithm. From the graph in Figure 2, it can be observed that the features that most influence the predictive process of the EIF algorithm are the features produced in the first stage of the MemAE algorithm. In particular, the second most influential feature is the cosine similarity measure calculated between the given input sample and the sample reconstructed by the autoencoder network. The fourth most influential feature is the Euclidean distance between the input sample and the sample reconstructed by the autoencoder network. Moreover, from the same figure, it is possible to see that some of the features related to the compressed representation Zc also rank among the 15 most influential features in the anomaly score prediction process. Notably, the third feature of the compressed sample ranks ninth. The graph provides information on how the values of a feature affect the analyzed Machine Learning model. In particular, it can be seen that low values for the feature cosine similarity (indicated with the color blue) imply a higher SHAP value for the analyzed feature. High values of the feature cosine similarity imply a lower influence of the analyzed feature using the EIF model. The inferred information is consistent with the definition of cosine similarity, which states that if the cosine similarity metric tends to zero, it implies that the compared samples are very different, while a metric with a value tending to 1 implies that the given input sample is very similar to the sample reconstructed by the autoencoder network. Thus, in the presence of anomalies, the value of the cosine similarity metric is very low, implying a high SHAP value. Similarly, it can be observed that high values of the characteristic euclidean distance (indicated with the color magenta) imply a high SHAP value. In contrast, low values of the feature euclidean distance imply a lower influence of the analyzed feature for the EIF model.