## 5 Experimental Results
### Causal Inference  
To investigate the causal question, causal inference methods are needed. In this study, the causal question is: Does the presence of specific network traffic characteristics cause a network flow to be classified as a DDoS attack versus benign traffic?  
The CICIoT2023 dataset includes the following features: packet rate, packet size distribution, source IP address frequency, and protocol type. To find the potential causal relationships between the features of the dataset, the following variables are considered: (1) Outcome: the classification of the network flow or attack type (specifically, 'DDoS' vs. 'BENIGN'). (2) Exposure: this is complex and not a single variable. The \"exposure\" is a combination of the 47 features representing various network traffic characteristics. For example, a high packet rate from a single source IP address, a large Tot size, specific protocol combinations (e.g., high UDP traffic), and the statistical summaries (Std, Variance) can be indicative of malicious activity. (3) Confounders: many potential confounders exist in this data. These are variables that might influence both the exposure (network traffic characteristics) and the outcome (BENIGN/DDoS classification) and thus create a spurious association. High congestion could independently cause high packet rates and also increase the likelihood of a successful DDoS attack.  
Figure 4a presents a causal graph derived from the CICIoT2023 dataset using the LiNGAM model. The graph shows the estimated causal relationships among various network traffic features, represented as nodes, with directed edges indicating the strength and direction of influence. The thickness of the edges visually represents the magnitude of the causal effect, with thicker lines indicating stronger influences. The graph's complexity reflects the intricate interplay of numerous variables within the dataset, providing a visual representation of the underlying causal structure governing network traffic patterns and potentially influencing the classification of benign versus malicious activity. The presence of both positive and negative causal relationships highlights the multifaceted nature of network traffic dynamics.  
The LiNGAM analysis reveals significant causal relationships between various network parameters and distributed denial of service (DDoS) attack occurrence. The directed edge from ack_flag_number to DDoS attacks exhibits a substantial positive coefficient (0.39), suggesting that ack_flag_number activity serves as a strong predictor of attack probability (as shown in Figure 4b). Specifically, a one-unit increase in ack_flag_number corresponds to a 0.39-unit increase in the probability of a DDoS attack. The analysis further identifies a moderate positive correlation between variance metrics and DDoS incidents, with a coefficient of 0.27. In contrast, Number and UDP parameters demonstrate weak negative associations with attack probability, yielding coefficients of \(-0.01\) and \(-0.03\), respectively.  
The identified causal relationships within the network traffic data provide significant conclusions that improve the interpretability of the model's predictions. The identified causal relationship between increased DNS activity and a higher chance of DDoS attacks enhances comprehension of the fundamental elements that differentiate malicious from benign network traffic. By tracing these causal pathways, the model's decision-making process becomes more transparent, allowing for an in-depth comprehension of its outputs beyond simple feature importance rankings. Examining the directionality and strength of such causal influences, as quantified through appropriate statistical measures, enables a more contextualized explanation of the model's predictions, ultimately improving the overall interpretability and trustworthiness of the system's performance.