# Cybersecurity Knowledge Extraction Using XAI
## 3 Results
### SHAP Dependence Plot with Interaction Feature  
Based on the previous analysis, it was concluded that when the port value is 80, the traffic may or may not be benign (see Figure 5a). In this case, further investigation and observation of the interaction feature are required. The best interaction feature in this particular case is the _PSH Flag Count_, a binary feature that takes the values 0 and 1. Figure 6 shows a SHAP dependence plot of the _Destination Port_ feature combined with the _PSH Flag Count_ interaction feature for the benign class. If a data instance takes the value of the _Destination Port_ feature 80, and if, at the same time, the _PSH Flag Count_ feature takes the value 1, it is most likely benign network traffic. Otherwise, it is most likely some kind of attack. A similar analysis can be performed for the port scan class. In the case where the _Destination Port_ attribute takes the values 21 or 22, it may or may not be a port scan attack (see Figure 5d). The best interaction feature in this case is the _Fwd Header Length.1_ feature (see Figure 7). High values of this feature indicate that it is not an infiltration attack. Although there are data instances with a low value of the _Fwd Header Length.1_ feature that belong to another class, it is highly likely a port scan attack if the feature takes low values. Finally, it is necessary to analyze what distinguishes different classes if both (or more) are characterized by the same values of a particular feature. Ports 21 and 22 were previously identified as being associated with port scan and brute force attacks. Finding an interaction feature that distinguishes these two classes is  
Figure 6: PSH Flag Count/Destination Port interaction for benign network. Figure 7: Fwd Header Length.1/Destination Port interaction for port scan attacks. required. The _Fwd Header Length.1_ feature is the best interaction feature in this case (see Figure 8). High values of the _Fwd Header Length.1_ feature are not typical of port scan attacks (see Figure 8a), but rather of brute force attacks (see Figure 8b). A similar analysis can be carried out for port 80. Port 80, in particular, is associated with benign traffic, as well as DoS and DDoS attacks. The _min seg size forward_ interaction feature is the most effective at distinguishing between DoS and DDoS attacks (see Figure 9). If the value of the _min seg size forward_ feature is high, it is most likely a DoS attack (see Figure 9a), and if it is low, it is most likely a DDoS attack (see Figure 9b). If the port value is 80, the _Flow IAT Mean_ feature best separates benign traffic and DoS attacks (see Figure 10). High values of the _Flow IAT mean_ feature are characteristic of DoS attacks, while low values are characteristic of benign traffic. Finally, the best interaction feature for distinguishing DDoS and benign classes in case the port takes the value 80 is the feature _Init_Win_bytes_forward_ (see Figure 11). High values of the _Init_Win_bytes_forward_ feature characterize benign traffic (see Figure 11a), whereas low values of the _Init_Win_bytes_forward_ feature characterize DDoS attacks (see Figure 11b). Figure 8: Fwd Header Length.1/Destination Port interaction plots. (**a**) Fwd Header Length.1/Destination Port interaction for port scan attacks; (**b**) Fwd Header Length.1/Destination Port interaction for brute force attacks. Figure 9: Min seg size forward/Destination Port interaction plots. (**a**) Min seg size forward/Destination Port interaction for DoS attacks; (**b**) Min seg size forward/Destination Port interaction for DDoS attacks. It is important to note that the SHAP method can identify more interaction features. Due to the length of the paper, the paper shows only a few. As previously stated in the decision tree's if-then rules, it is not possible to determine how much each feature value influences the prediction. The if-then rules can be used to identify feature interactions. Features that interact with each other are on the same path in the tree and are part of the same rule.