[论文解读] Classification and Explanation of Distributed Denial-of-Service (DDoS) Attack Detection using Machine Learning and Shapley Additive Explanation (SHAP) Methods

Yuanyuan Wei, Julian Jang‐Jaccard+3 more|arXiv (Cornell University)|Jun 27, 2023

Network Security and Intrusion Detection被引用 4

一句话总结

本文提出了一种结合特征选择与可解释人工智能的机器学习框架，以实现高精度和可解释性的DDoS攻击检测。基于CICDDoS2019数据集的前20个特征训练的MLP分类器，结合SHAP解释，使模型在一对一和一对多分类场景下的准确率均超过99%，SHAP提供了对特征对预测贡献的全局与局部可解释性。

ABSTRACT

DDoS attacks involve overwhelming a target system with a large number of requests or traffic from multiple sources, disrupting the normal traffic of a targeted server, service, or network. Distinguishing between legitimate traffic and malicious traffic is a challenging task. It is possible to classify legitimate traffic and malicious traffic and analysis the network traffic by using machine learning and deep learning techniques. However, an inter-model explanation implemented to classify a traffic flow whether is benign or malicious is an important investigation of the inner working theory of the model to increase the trustworthiness of the model. Explainable Artificial Intelligence (XAI) can explain the decision-making of the machine learning models that can be classified and identify DDoS traffic. In this context, we proposed a framework that can not only classify legitimate traffic and malicious traffic of DDoS attacks but also use SHAP to explain the decision-making of the classifier model. To address this concern, we first adopt feature selection techniques to select the top 20 important features based on feature importance techniques (e.g., XGB-based SHAP feature importance). Following that, the Multi-layer Perceptron Network (MLP) part of our proposed model uses the optimized features of the DDoS attack dataset as inputs to classify legitimate and malicious traffic. We perform extensive experiments with all features and selected features. The evaluation results show that the model performance with selected features achieves above 99\% accuracy. Finally, to provide interpretability, XAI can be adopted to explain the model performance between the prediction results and features based on global and local explanations by SHAP, which can better explain the results achieved by our proposed framework.

研究动机与目标

• 解决在确保模型可解释性以供安全专家理解的前提下，实现高精度检测DDoS攻击的挑战。
• 通过使用多种特征重要性技术选择最相关特征，降低模型复杂度并提升性能。
• 利用SHAP提供透明、人类可理解的模型预测解释，实现全局与局部可解释性。
• 在一对一（良性与单一攻击类型）和一对多（良性与多种攻击类型）分类场景下评估该框架。
• 证明可解释人工智能可增强对黑箱模型在网络安全应用中信任度。

提出的方法

• 使用三种基于XGBoost的特征重要性技术进行特征选择：基于XGBoost的特征重要性、置换特征重要性以及SHAP特征重要性。
• 从CICDDoS2019数据集中选取最具影响力的前20个特征，形成优化后的特征子集。
• 在优化后的特征子集上训练多层感知机（MLP）分类器，用于对良性与恶意流量进行二分类。
• 在两种场景下评估模型性能：一对一（良性 vs. 一种攻击类型）与一对多（良性 vs. 多种DDoS攻击类型）。
• 应用核SHAP（Kernel SHAP）对模型预测进行全局与局部解释，可视化特征对分类结果的贡献。
• 使用力图（force plots）解释单个预测，展示哪些特征推动预测结果向良性（1.00）或恶意（0.00）类别偏移。

实验结果

研究问题

• RQ1 仅使用CICDDoS2019数据集中前20个最重要特征的机器学习模型，是否能在分类DDoS攻击时实现超过99%的准确率？
• RQ2 不同特征重要性技术（XGBoost、置换、SHAP）在识别DDoS检测相关特征方面表现如何比较？
• RQ3 SHAP在多大程度上能为MLP分类器对DDoS流量的预测提供有意义的局部与全局解释？
• RQ4 哪些关键特征对模型将流量分类为良性或恶意的决策影响最大？
• RQ5 特征选择与SHAP可解释性相结合，能否提升对黑箱DDoS检测模型的信任？

主要发现

• 当在前20个选定特征上训练时，MLP分类器在一对一和一对多分类场景下的准确率均超过99%。
• 特征'Inbound'始终是主要贡献者，其值为0或1时显著影响预测结果向良性或恶意类别偏移。
• 基于SHAP的局部解释清晰识别出误分类实例，例如良性流量因'Inbound'（0）和'Min Packet Length'（0）等特征贡献过高而被错误分类为恶意。
• 全局SHAP解释按重要性降序排列特征，其中'Min Packet Length'、'Fwd Packet Length Min'和'Inbound'为最具影响力的特征。
• 力图有效可视化了单个特征对预测结果的影响，显示了对良性或恶意标签具有正向（红色）或负向（蓝色）贡献的特征。
• 该框架成功证明，通过减少特征集可在保持SHAP可解释性的前提下实现高精度DDoS检测。