## 5 Results and Discussion
### LSTM Model Explanation
\begin{table}
\begin{tabular}{c c} \hline
**Class (\# Features)** & **Features (LIME \(\cap\) SHAP \(\cap\) Anchor \(\cap\) LORE)** \\ \hline
**Benign (23)** & 8, 12, 14, 15, 17, 18, 23, 24, 26, 28, 29, 34, 35, 36, 40, 41, 44, 45, 46, 51, 55, 59, 60 \\ \hline
**GoldenEye (13)** & 7, 15, 18, 19, 22, 27, 32, 33, 47, 48, 50, 54, 60 \\ \hline
**Hulk (17)** & 14, 15, 18, 19, 21, 23, 28, 33, 42, 43, 46, 47, 48, 49, 54, 58, 60 \\ \hline
**Slowhtop (22)** & 7, 13, 14, 15, 20, 23, 27, 28, 32, 33, 36, 42, 43, 46, 47, 48, 50, 51, 54, 55, 58, 59 \\ \hline
**Slowloris (17)** & 13, 14, 15, 21, 22, 23, 27, 28, 32, 33, 36, 42, 43, 48, 50, 51, 55 \\ \hline
**HOIC (14)** & 6, 13, 15, 16, 18, 19, 25, 33, 42, 43, 45, 46, 47, 48 \\ \hline
**LOIChttp (20)** & 6, 12, 13, 14, 15, 17, 22, 24, 25, 26, 27, 28, 29, 30, 42, 44, 45, 46, 50, 54 \\ \hline
**DNS (33)** & 6, 10, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 27, 28, 29, 31, 33, 34, 35, 36, 42, 43, 44, 45, 46, 47, 48, 53, 54, 56, 58 \\ \hline
**LDAP (18)** & 10, 16, 17, 18, 21, 22, 23, 24, 28, 29, 31, 32, 33, 34, 35, 36, 42, 43 \\ \hline
**MSSQL (22)** & 10, 12, 16, 19, 20, 21, 22, 23, 24, 27, 28, 29, 32, 33, 34, 35, 42, 44, 45, 58, 59, 76 \\ \hline
**NTP (25)** & 6, 11, 12, 14, 16, 17, 18, 19, 21, 31, 32, 33, 34, 35, 36, 42, 43, 45, 48, 53, 55, 56, 57, 59, 60 \\ \hline \end{tabular}
\end{table} 
Table 10: Common features between LIME, SHAP, Anchor, and LORE explanations for each class. # refers to the number of features. Figure 6: Intersections between the explanation methods for each class in CIC datasets. From the confusion matrix in Figure 5, we note that the model exhibits confusion between DNS, LDAP, and SNMP and between UDP, SSDP, SYN, and UDP-Lag classes. The similarity in the nature of some DDoS attacks can be reflected in the feature values of the captured dataset, thereby confusing the model and resulting in a decrease in the performance detection of these classes. [PERSON] et al. [49] presented three scenarios to improve the classification CICDDoS2019 approach. One of these scenarios is unifying the DDoS attacks with significant similarities in the feature space. The similarity between the features of these classes was calculated by statistical metrics (ACV, AFR0, and ASAH). ACV indicates features with a constant value, AFR0 summarizes the features with frequent zeros greater than 98%, and ASAH refers to the features having a significant bias with homogeneity in their values greater than or equal to 96%. In our work, we exploit the overlap between the common features in Table 10 of each class to explain the low performance of the LSTM and show the similarity between the confused classes. Table 11 shows the percentage of similarity between the pair of common features of CIC classes in Table 10.  
For easy representation, we map the name of CIC classes into sequence numbers of the letter \"C\", as shown in Table 12. We note from Table 11 that almost all the feature similarity that is over or equal to 50%, with bold black, is between CICDDoS2019 classes from C8 to C18. This similarity could confuse the model and result in a decrease in the performance detection of some of the CICDDoS2019 classes. To address the confusion issue, we unify the classes with similar features greater than 50%. From Table 11, we note that the DNS class has similar features with SNMP, NetBIOS, and TFTP with percentages of 65%, 61%, and 56%, respectively. We unify these classes together and call them Group 1. We also note that the UDP class has similar features with NTP, SYN, and UDP-Lag with percentages of 70%, 58%, and 54%, respectively. These classes are unified in Group 2. Figure 7 shows the confusion matrix on the test part of the CICDDoS2019 dataset after retraining the LSTM classifier with a new grouping of classes. We noticed that there is still confusion between Group 1 and the LDAP class and between Group 2 and the SSDP class.