# Detecting Web-Based Attacks with SHAP and Tree Ensemble Machine Learning Methods
## 3 Proposed Method
### Preprocessing
#### 3.1.2 Sample JS Attack Codes
Finally, we analyzed the feature importance of each AST-JS feature selected using SHAP values to understand how different features influence our malicious JS code detection model's performance. This process was achieved in two parts: first, we used our original AST-JS features and then the AST-JS combination features extracted through association rule mining. Next, we explain the feature selection process. ### Feature Selection

The feature selection process comprises sample JS attack codes, association rule mining, and SHAP values. The sample JS attack codes are used to obtain AST-JS feature combinations based on expression, pattern, statement, and declaration nodes. AST-JS feature combinations augment the AST-JS node features by capturing JS-based attacks. The JS-based attacks include variable obfuscation, attacks using eval and unescape, attacks using the current context or browser objects, user environment detection, string obfuscation, string concatenation, encoding functions, nested function calls, function obfuscation, and attacks combining string concatenation with function obfuscation. Association rule mining is used to measure how often AST-JS nodes appear together in benign and malicious JS codes. Features obtained using Association rule mining are used for performance comparison. SHAP values are used to determine AST-JS feature interactions, and a feature set is selected based on the contribution to the detection performance for malicious JS code. Next, we explain the SHAP features' importance. ### Shapley Additive Explanations' Feature Importance

SHAP is a game-theoretic approach that explains any machine learning model's output that connects optimal credit allocation with local explanations using the classical Shapley values and their related extensions [44; 45; 46]. The values show the extent to which a feature is responsible for a change in the model's output. SHAP values either increase or decrease the model's prediction values and balance out the input's actual prediction. The prediction starts from the base value, the mean derived from the entire prediction. Our premise is that interpreting the malicious JS code detection model's output will guide AST-JS feature selection, further improving its performance. Identifying the most-impactful features may enable us to derive other features with additional information to improve the detection performance. This knowledge will also provide necessary insights into the distribution of specific benign and malicious JS code features. A JS code input is represented as \(Z\) with a set of AST-JS features \(z_{1}\), \(z_{2}\), \(\ldots\), \(z_{n}\), and its corresponding output \(Z^{\prime}\) and predicted features \(z^{\prime}1\), \(z^{\prime}2\), \(\ldots\), \(z^{\prime}n\), using the tree ensemble model \(g\). Algorithm 2 shows the procedure for calculating tree SHAP values using tree ensemble methods that return AST-JS features (line 6) sorted in descending order of their importance. First, we obtained AST-JS features from the JS code dataset and saved them as AST-JS \(M\) features. For each feature \(z^{\prime}i\) in the AST-JS \(M\) features, we used tree SHAP to obtain the SHAP values. When predicting the observed feature \(z^{\prime}i\), the SHAP importance values for each feature, \(z_{1}\), \(z_{2}\), \(\ldots\), \(z_{n}\), excluding \(z_{i}\), were calculated. Tree SHAP receives \(g\) and a background set with \(j\) instances to build the local explanation model and calculate the SHAP values. Then, \(g\) takes \(Z\) and \(i\) as input and predicts \(Z^{\prime}\); the value in the \(i\)-th feature, a feature in the AST-JS \(M\) features, is returned by Algorithm 3. This results in a two-dimensional list of the \(SHAPsortedM\) features. Each row in the list represents the SHAP values one of each AST-JS feature in \(M\) features.