# Polymorphic Adversarial Cyberattacks Using WGAN
## 4 Dataset and Feature Selection
### Feature Selection  
Feature selection is an essential aspect of machine learning. If we train the model without determining the critical features of the dataset, the predicted results will have more noise and uncertain results. Moreover, while using a dataset with a higher number of  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Feature** & **Values** \\ \hline Total number of flows & 2,830,540 \\ Total number of features & 83 \\ Number of classes/labels & 15 \\ \hline \hline \end{tabular}
\end{table}
Table 1: Properties of the CICIDS2017 dataset.  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Normal/Attack Labels** & **Number of Flows** \\ \hline BENIGN & 2,359,087 \\ BOT & 1966 \\ DDOS & 41,835 \\ DOS GOLDENYE & 10,293 \\ DOS HULK & 231,072 \\ DOS SLOW HITTPETST & 5499 \\ DOS SLOWLORIS & 5796 \\ FITP-PATATOR & 7938 \\ HEARTBLEED & 11 \\ INFILTRATION & 36 \\ FORTGSCAN & 158,930 \\ SSH-PATATOR & 5897 \\ WEB ATTACK—BRUTE FORCE & 1507 \\ WEB ATTACK—SQL INJECTION & 21 \\ WEB ATTACK—XSS & 652 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Labeled features in CICIDS2017.  
feature sets, it is unnecessary to use all the available features since the machine learning method requires more resources and time to process a large volume of data with additional features. Among several techniques to select important features from a dataset, we have employed SHAP in this research.  
Feature Selection using SHAP  
**Shapley Additive exPlanations (SHAP)**[18] is a feature selection technique whose goal is to signify the contribution of each feature to the predicted value. SHAP aims to satisfy two critical measures to define feature importance, which are consistency and accuracy. The idea behind Shapley values is that the outcome of each possible combination (or coalition) of features needs to be examined to determine the importance of a single feature. The mathematical explanation of this is as follows:  
\[g(z^{\prime})=\mathbf{\phi}_{0}+\sum_{j=1}^{M}\mathbf{\phi}_{j}z^{\prime}_{j} \tag{4}\]  
where \(\mathbf{g}\) represents the overall result of the Shapley values, \(z^{\prime}e\left\{0,\ 1\right\}M\) is a coalition vector, \(\mathbf{M}\) is the max coalition size, and \(\mathbf{\phi}_{j}\) represents the presence of feature \(\mathbf{j}\) that contributes towards the final output. In the coalition vector, 0 means the corresponding value is \"not present\" and 1 means it is \"present\".  
Herein, each node represents a coalition of features. Edges represent the inclusion of a feature that was not present in the previous coalition. Equation (4) trains each coalition in the power set of the features to find the most critical feature from the dataset. The advantages of using SHAP are as follows:  
* Global Interpretability: This technique provides essential features from a dataset and a contribution of each feature for a target result and effect of the feature. To calculate global importance, we need to find an average of SHAP vales. \[I_{j}=\sum_{i=1}^{n}\left|\mathbf{\phi}_{j}^{(i)}\right|\] (5)
* Local Interpretability: With this method, we can get an impact of an individual feature across the whole dataset.  
We ran the SHAP explainability model on the CICIDS2017 DDoS/DoS data. Figure 2 is known as a summary plot that can represent an effect of the feature, positive or negative, on the result. Furthermore, the dark red color represents a higher impact of a feature, and the blue color represents a lower impact of a feature on the output value.  
We use the results of the SHAP analysis, such as those in Figure 2, in our feature selection stage. These results identify the functional features (attack features) that are used by IDS, and the non-functional features that would be used in creating polymorphic attacks while keeping functional features constant. SHAP analysis helps us separate functional and non-functional features by quantifying the impact of each feature on the correct identification of the attack data.