# Detecting Web-Based Attacks with SHAP and Tree Ensemble Machine Learning Methods
## 3 Proposed Method
### Preprocessing
#### 3.1.2 Sample JS Attack Codes
The SHAP values are plotted on the x-axis for each AST-JS feature on a row sorted by the sums of their SHAP value magnitudes. The vertically piled points represent the feature density, and the colors show the feature values. The values give the distribution of each AST-JS feature's impact on the model's output. The red and blue colors represent high and low AST-JS feature values. The color allows us to visualize how changes in the value of an AST-JS feature would affect a change in prediction; for example, high SHAP values for the \(SequenceExpression\) feature would indicate a high risk of maliciousness for a JS code. Using such plots, we can deduce that features such as the \(ObjectExpression\) would influence the model's prediction more than the \(LabelStatement\). A feature such as \(SequenceExpression\) has a significant, positive effect on AST-JS prediction, and therefore, a high \(SequenceExpression\) SHAP value may indicate a higher risk for maliciousness. On the contrary, a feature such as the \(FunctionExpression\) has a significant, negative effect on the AST-JS class prediction, and therefore, a low \(FunctionExpression\) SHAP value may indicate a higher risk for maliciousness. Additionally, interesting patterns can be observed, such as high values of the \(ExpressionStatement\_CallExpression\_Identifier\) feature clustered in a very dense region represented by the red blob. Additionally, low values of the \(BlockStatement\) feature are clustered in a very dense region, as shown by the blue blob. However, features such as the \(ReturnStatement\) and \(FunctionExpression\) have a much more uniform distribution with high and low SHAP values, respectively, pushing the prediction to 1. The red and blue blobs on the left and right indicate an even distribution of that feature in the JS code dataset. Some features such as \(EmptyStatement\_ExpressionStatement\_CallExpression\) and \(CallExpression\_Identifier\_Literal\) are not crucial for most JS codes. However, these fea \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Model** & **Recall** & **Precision** & **F1** \\ \hline XGBoost & 0.9981 \(\pm\) 0.0008 & 0.9698 \(\pm\) 0.0033 & 0.9838 \(\pm\) 0.0018 \\ LightGBM & 0.9979 \(\pm\) 0.0008 & 0.9691 \(\pm\) 0.0032 & 0.9833 \(\pm\) 0.0019 \\ RandomForest & 0.9986 \(\pm\) 0.0005 & 0.9702 \(\pm\) 0.0032 & 0.9842 \(\pm\) 0.0018 \\ DecisionTree & 0.9983 \(\pm\) 0.0005 & 0.9687 \(\pm\) 0.0029 & 0.9833 \(\pm\) 0.0016 \\ LogisticRegression & 0.9839 \(\pm\) 0.0021 & 0.9414 \(\pm\) 0.0039 & 0.9622 \(\pm\) 0.0025 \\ KNeighbors & 0.8448 \(\pm\) 0.0062 & 0.9986 \(\pm\) 0.0006 & 0.9153 \(\pm\) 0.0037 \\ GaussianNB & 0.9968 \(\pm\) 0.0013 & 0.5493 \(\pm\) 0.0029 & 0.7083 \(\pm\) 0.0025 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Performance comparison using AST-JS node features. tures significantly impact a subset of JS codes in the dataset. This scenario highlights how a globally important feature is not necessarily the most critical feature for attack detection in JS codes. Figure 3 shows the SHAP dependence plot for the top AST-JS feature before (a) and after (b) feature selection. Every dot represents a JS code. Vertical dispersion at an AST-JS feature value results from interaction effects in the model. The color highlights the high or low forces behind the interactions. The y-axis represents the SHAP values. The SHAP summary plot is obtained by projecting the SHAP dependence plot points onto the y-axis and recoloring the value's feature. The \(TryStatement\) and \(VariableDeclaration\) features were automatically selected for coloring based on a potential interaction in the model. Plot (b) shows that low SHAP values of the \(ObjectExpression\) feature influence the model's output more significantly for observations where the \(VariableDeclaration\) feature has high SHAP values. Figure 4 shows the SHAP interaction values plot for the top two AST-JS features before (a) and after (b) feature selection. It shows the main effects and interaction effects for the \(ObjectExpression\) feature.