# Detecting Web-Based Attacks with SHAP and Tree Ensemble Machine Learning Methods
## 1 Introduction  
Websites are very popular; hence, cybercriminals find these platforms to be perfect tools for launching their attacks. Web-based attacks remain a significant challenge, as evasion techniques are continuously evolving. Attackers compromise Uniform Resource Locators (URLs) and their JavaScript (JS) content to perform malicious activities on the Internet. Such activities include phishing, URL redirection, spamming, social engineering, botnets, and drive-by-download exploits [1, 2, 3]. The attacks are delivered through emails, malware advertisements, texts, pop-ups, malicious scripts, and search results. The Domain Name System (DNS) [1, 2, 3, 4, 5] provides cybercriminals the flexibility to easily migrate their malicious servers, as they hide the IP addresses behind domain names [2, 3]. Securing websites is vital for maintaining confidentiality, integrity, and availability, and an equally adaptive strategy is required to detect such attacks effectively. Methods such as maintaining a blocklist [6], client honeypots, domain reputation inspection [4], and domain and web metrics analysis [5, 7, 8, 9] can detect malicious URLs and their JS code content [4, 10, 11]. However, new URLs are registered every day, and a blocklist can be evaded through URL obfuscation, fast flux, cloaking, and URL shortening. Recently,machine learning approaches that employ feature extraction and representation learning for malicious URLs and their JS code content detection have been proposed [2; 3; 12; 13; 14]. Machine learning algorithms learn a prediction function based on features such as lexical, host-based, URL lifetime, and content-based features that include HyperText Markup Language and JS code. A classifier is then used to predict whether given content is malicious or benign using a test dataset. Models such as these can be generalized to new data, unlike the blocklist approach. However, there are challenges in crafting fully representative features for model training. In our previous work [15; 16; 17], we developed a system to detect malicious JS codes using fixed-length vectors and the Abstract Syntax Tree form of the JS code (AST-JS). This study extends our work by detecting malicious JS code content through feature selection. Using atomic features and allowing the model to determine the relationships between them is preferable instead of using composite features [2; 3]. This study proposes using Shapley additive explanations (SHAP) values and tree ensemble methods. While other methods learn a set of manually extracted or engineered features, our approach adopts features that are automatically selected based on their contributions to the model's output. Malicious URLs and their JS code content can stealthily perpetrate web-based attacks [15; 16; 17; 18]. Other studies [12; 19; 20] have shown that malicious URLs and their JS code content exhibit features that are distinct from those of legitimate URLs. Therefore, we focused on JS code content-based features to detect malicious websites. Our premise is that malicious JS code content originating from attackers exhibits different AST-based features than legitimate content. A SHAP-based model would learn such features from the distribution of continuously evolving malicious JS code content. The main contributions of this study are the following:  
* This study proposes using SHAP and tree ensemble methods for detecting web-based attacks. * We detail the process of obtaining features using AST-JS node sets and patterns, sample JS attack codes, and association rule mining. * We compared the performances of different classifiers in malicious JS code detection using SHAP selected features and achieved good detection performance for the tree ensemble methods. * We compared the performance of SHAP selected features to the performance of those selected by other feature selection methods: Boruta, EL15, RandomForest, and SelectKBest. * The proposed web-based attack detection method outperformed the other feature selection methods in all three evaluation metrics.