## 4 Experiment Results
### SHAP Value Analyses
#### 4.1.1 Flooding Scenario Dataset Analysis  
As a result of the SHAP analysis of flooding scenario datasets (scenario types 01 and 02), the ninth and seventh data bytes and the data length were determined to be the most important features. These results are consistent with the flooding payload analysis analyzed in Table 14. This model analyzed the key features of the flooding payload, such as the data length and Transfer ID. Table 15 shows the SHAP value distribution among the feature values, Feature Importance, and important features determined via the analysis of the scenario type 01 dataset. In the feature value graph, you can see that data length is concentrated around two values near the SHAP value of 0.0. This shows that the data lengths of the flooding payload are all seven and eight, and feature values are concentrated in that section. Additionally, the blue dots with relatively low feature values are concentrated in the range from \(-0.6\) to \(-0.2\) based on the SHAP value, and most of the normal driving data are distributed with a length other than seven or eight. \begin{table}
\begin{tabular}{c c} \hline \hline
**Model** & **Hyperparameter** \\ \hline Decision Tree \#1 & max\_depth =5 \\ \hline Decision Tree \#2 & max\_depth =15 \\ \hline Random Forest Classifier & n\_estimators = 50 \\ \hline \multirow{4}{*}{DNN \#1} & input\_shape = 9, \\  & hidden layer 01(relu) shape = 4, \\  & hidden layer 02(relu) shape = 3, \\  & output layer(sigmoid) shape = 1 \\  & Epoch = 20 \\ \hline \multirow{4}{*}{DNN \#2} & input\_shape = 9, \\  & hidden layer 01(relu) shape = 4, \\  & hidden layer 02(relu) shape = 3, \\  & output layer(sigmoid) shape = 1, Epoch = 30 \\ \hline \multirow{4}{*}{RNN} & Optimizer = ’Adam’, \\  & Loss = ’binary cross entropy’, Epochs = 30, \\  & batch size = 128, verbose = 2 \\ \hline \multirow{4}{*}{LSTM} & Input\_shape = 9, \\  & Hidden layer 01(LSTM) shape = 32, \\  & Hidden Layer 02(LSTM) shape = 16, \\  & Flatten layer shape = 144, \\  & Hidden Layer 03(Dense) shape = 8, \\  & Output Layer shape(sigmoid) = 2 \\ \hline \hline \end{tabular}
\end{table} 
Table 13: _Cont._ \begin{table}
\begin{tabular}{c c} \hline SHAP Value Distribution by Feature determined & Feature Importance determined using Tree \\ using Tree Explainer (Type 02 Dataset) & Explainer (Type 02 Dataset) \\ \hline \hline \end{tabular}
\end{table} 
Table 15: SHAP analysis for scenario type 02. Figure 7 shows a SHAP force plot for three random rows of data. The red section represents where the SHAP value is high, and the blue section denotes where the SHAP value is low. The ninth data byte and data length of the first and second graphs in Figure 7 are clearly different from those in the third graph. This means that the flooding payload has a feature for flooding attacks in the ninth data byte and is judged according to the data length. We can confirm that the evidence has been classified. SHAP value analysis was performed on the data length, which had a high correlation coefficient with other data, and the ninth data byte, which had the highest feature importance value. Scenario datasets 01 and 02 are related to flooding attacks, and in the SHAP analysis results shown in Figure 8, the sixth, seventh, and ninth data bytes were commonly selected as important features. Additionally, when analyzing the SHAP value distribution of the sixth and seventh data bytes in scenario type 01, a specific pattern emerged. Table 15 shows the SHAP value distribution between the feature values, Feature Importance, and important features through the analysis of the scenario type 02 dataset. It presents the analysis of the same flooding attack dataset as Table 14 does. Therefore, in the Feature Importance graph, the ninth and seventh data bytes and the data length are selected as important features. However, in the SHAP value distribution graph, both the blue and red dots show a more biased distribution, and because type 02 has a higher unbalanced normal-attack ratio than type 01 does, SHAP analysis was performed.