# Automatic False Alarm Detection Based on XAI and Reliability Analysis
## 3 Materials and Methods
### Preparing for Analysis  
We learn the AI model after preprocessing the raw dataset so that it is suitable for learning. After that, two tasks must proceed to generate the indicators. First, it is necessary to select important features. Second, we generate an outlier calculation module.  
SHAP is an algorithm that measures the contribution of each feature to the prediction when an AI model predicts data. SHAP uses the SHAP value as a basis for explanation. The SHAP value is a sampling value that measures the degree of influence through the extracted SHAP value. The formula for extracting the SHAP value is as follows:  
\[\phi_{i}=\sum_{S\subseteq F\backslash i}\frac{|S|!(|F|-|S|-1)!}{|F|!}[f_{S \cup i}(x_{S\cup i})-f_{S}(x_{S})]\phi_{i} \tag{1}\]  
where \(\phi_{i}\) represents the SHAP value for the \(i\)-th instance; \(F\) represents the entire set; \(S\) represents all subsets except for the \(i\)-th instance in the entire set; \(f_{S\cup i}(x_{S\cup i})\) represents the contribution that includes the \(i\)-th instance; and \(f_{S}(x_{S})\) represents the contribution of the subset without the \(i\)-th data. The AI model trained on the training dataset calculates the SHAP value for the training dataset through the SHAP explainer. It is possible to check the extracted SHAP value of one instance through the force plot, as shown in Figure 2. The SHAP value of the feature called \"DllCharacteristics\" of the instance is 0.7872; thus, this feature can be interpreted as a feature that contributes to malware prediction.  
After the algorithm calculates the SHAP value for each instance, the training dataset is classified by the label. We created a SHAP summary plot of the data corresponding to each label and selected important features based on the summary plot. Figure 3 shows the summary plot for predicting malware based on the malware dataset. The x-axis of the plot is the SHAP value of an instance, each point corresponds to an individual instance, and high and low feature values are represented in color. In Figure 3, \"CheckSum\" has the largest average SHAP value at the top, and it can be seen as the feature that contributes to the prediction the most. It can be interpreted that the blue instances distributed on the left have a negative effect on judging instances as malware because the feature value is small and the SHAP value is small, and it can be interpreted that the instances distributed on the right have a positive effect on judging instances as malware. Based on the distribution of these SHAP values, it is possible to explain the basis for the prediction of the AI model. A summary plot is used to select important features and to generate indicators. The criteria for the selection of important features are as follows. The contribution of the feature itself is ranked high, and the interpretation of the shape value distribution for each feature value should be clear. In addition, features have a positive effect on predicting using the label.  
Figure 2: Force plot to provide the explainability of a single-model prediction.  
Next, an outlier calculation module is created. Outlier calculation refers to how far the data are from other data and how different they are. The outlier algorithm measures the degree of difference based on all feature values in the training dataset. It implies how far away the input data from the general trend of the training dataset are because AI can precisely determine minute differences that analysts cannot identify.