# Cybersecurity Knowledge Extraction Using XAI
## 2 Materials and Methods
### The CIC-IDS2017 Dataset Description  
The CIC-IDS2017 dataset contains data related to benign network traffic and a wide range of contemporary attack scenarios, closely approximating authentic real-world data. This dataset was created by the Canadian Institute of Cybersecurity, the data being taken from a simulation that is considerably closer to how a modern computer network behaves compared to the older popular datasets from this domain, with the attacks being carried out with the help of established online tools and tactics. This dataset was hence chosen as the cornerstone research data for this paper.  
The original dataset contains 2,830,743 data instances collected over 5 days and described by 79 features (see Table 1). The process of further data preparation was performed in three main steps: data cleaning, data transformation, and feature selection.  
Data cleaning step. Infinity and missing values were removed from the CIC-IDS2017 dataset, which resulted in a dataset reduction of 2867 data instances. Following that, the zero variance features (_Bud PSH Flags_, _Bud URG Flags_, _Fud Avg Bytes/Bulk_, _Fud Avg Packets/Bulk_, _Fud Avg Bulk Rate_, _Bud Avg Bytes/Bulk_, _Bud Avg Bulk Rate_) were eliminated. After this step, the dataset contained 2,827,876 rows and 70 columns.  
Data transformation step. The CIC-IDS2017 dataset contains benign traffic and 14 different types of attacks (_DoS Hulk_, _PortScan_, _DDoS GoldenEye_, _FTP-Patator_, _SSH-Patator_, _DoS slowloris_, _DoS Slowhittptest_, _Bot_, _Web Attack Brute Force_, _Web Attack XSS_, _Infiltration_, _Web Attack Sql Injection_, _Heartbleed_) and is highly imbalanced. The majority _benign_ class has a prevalence of 80.32%, while the minority _heartbleed_ class has a prevalence of 0.00039%. Due to the under-representation of certain types of attacks, this paper conflated some of the classes while removing others altogether. More precisely, _DoS Hulk_, _DoS GoldenEye_, _DoS slowloris_, and _DoS Slowhittptest_ attacks were merged into the DoS class. _FTP-Patator_ and _SSH-Patator_ were merged into the Brute Force class. The _benign_, and _port scan_ attack classes were held in their original form, and other attack types were removed from the dataset. The final dataset, therefore, contained benign traffic and 4 classes of attacks--DoS attacks, DDoS attacks, brute force attacks, and port scan attacks. This dataset was then divided into a training set and test set (70:30), with random oversampling and random undersampling being performed on the training part of the dataset for the purposes of class balancing.  
Figure 2: Guidelines for opening the black box model using the SHAP method.  
Feature selection step. This paper uses the SHAP feature importance method. The SHAP feature importance method measures the influence of a feature by comparing the model prediction with and without the feature, and ranks features with larger absolute Shapley values as more important. The method is consistent and accurate [40], and does not overestimate the importance of continuous or high-cardinality categorical variables as native tree-based feature importance methods do. The method chose 12 most important features: _Destination Port_, _Bwd Packet Length Min_, _Init_Win_bytes_backward_, _Subflow Fwd Bytes_, _Packet Length Mean_, _min_seg_size_forward_, _Bwd Packets/s_, _PSH Flag Count_, _Fwd Header Length.1_, _Init_Win_bytes_forward_, _Flow IAT Mean_, and _Total Length of Fwd Packets_.