# Cybersecurity Knowledge Extraction Using XAI
## 1 Introduction
In other words, the quality and amount of input data are crucial in any machine learning challenge. The same principle works when it comes to the process of explaining a black box model. When using high-quality and realistic data, better patterns can be extracted, and the true state of the system can be obtained. Even though this is a relatively new field of study, there are already a number of papers in the scientific literature that deal with the use of explainable machine learning in the domain of cybersecurity. These papers primarily leverage the KDD Cup 99 [28] and the NSL-KDD datasets [29; 30; 31; 32], with their most important findings being summarized in the continuation of this paragraph. [PERSON] et al. [29] present a deep neural network anomaly detection framework that provides explanations of detected anomalies. Explanations are provided in the form of a list of features, and their ratings calculated using the layer-wise relevance propagation (LRP) method that indicates the importance of each feature in a specific classification. The research focuses solely on denial of service (DoS) attacks, i.e., distinguishes between benign network traffic and DoS attacks. [PERSON] et al. [28] employ a decision tree and extract if-then rules that are used  
Figure 1: Gartner hype cycle. to discover a set of features that separate benign and malignant traffic (binary classification). The authors calculate feature importance using the entropy measure. [PERSON] et al. [30] present an adversarial approach for generating explanations of data instances that have been incorrectly classified. The approach is used to find the least attribute modifications needed for misclassified data instances to be classified correctly. The size of these modifications is used to determine the most important attributes that explain why the classification is incorrect. Such explanations can be applied to a single data instance or to a group of incorrectly classified data instances, in which case the average attribute modification is applied. The paper employs two approaches to network traffic classification, linear and multilayer perceptron classifiers. The authors of [31] describe a deep neural network for network traffic classification and five algorithms for explaining its results. Shapley additive explanations (SHAP), local interpretable model-agnostic explanations (LIME), contrastive explanation method (CEM), ProtoDash, and Boolean decision rules via column generation (BRCG) are the used explanatory algorithms, and explanations are generated both locally and globally. The paper performs binary classification. [PERSON] et al. [32] explain the results of two classifiers, the one-vs-all classifier, and the multiclass classifier, using the SHAP method. Local explanations attempt to determine why a specific instance is classified in a particular manner, whereas global explanations identify the most important attributes that distinguish individual classes. Both the KDD Cup 99 dataset and the NSL-KDD dataset have significant flaws--most notably, the obsolescence of attacks in the datasets as well as the synthetic origin of the datasets. In 2017, the Canadian Institute for Cybersecurity released a new dataset--CIC-IDS2017. This dataset contains benign network traffic and a wide range of more contemporary attack scenarios, closely resembling authentic real-world data. This is what currently makes the CIC-IDS2017 a much better choice when building and explaining machine learning models in the cybersecurity domain. Several papers already used the CIC-IDS2017 dataset in the domain of explainable machine learning. [PERSON] [33] uses explainable machine learning models to improve the performance of the intrusion detection systems. The author analyzes the extreme gradient boosting (xgboost) model performance by comprehending feature influence and removing unnecessary features. The author then compares the performance of model post-explainability-based feature selection to that of prior-explainability-based feature selection.