Abstract:

Reconnaissance attacks serve as the initial phase of Advanced Persistent Threats (APTs). The study proposes CluSHAPify, an approach that integrates SHAP-based traffic metadata selection with hierarchical clustering interpretations to determine the most relevant features for attack detection across different attack flow classes. Unlike most studies that select the top-k features, the proposed study uses hierarchical clustering to justify the selection of features identified with the highest SHAP values ensuring the most relevant features are chosen for effective attack detection across different attack flow classes. Additionally, CluSHAPify leverages multiple learners, making it a cross-model approach that also overcomes the limitations of SHAP-based feature selection, which is inherently model-dependent. The proposed approach uses multiple learners to improve feature selection robustness by capturing diverse perspectives, combining XAI for enhanced accuracy and explainability, a novel approach in existing research. This study uses performance metrics designed for unbalanced datasets, demonstrating its effectiveness with various learners, including XGBoost, Random Forest, Decision Tree, and Extra Trees. This makes CluSHAPify a reliable and adaptable solution for detecting reconnaissance attacks in IIoT environments.

Key words: feature selection, IIoT, APT, reconnaissance attacks, OS fingerprinting, port scanning, machine learning, SHAP values, XAI