USAGE OF XAI ON NEAREST NEIGHBORS FOR DDOS ATTACKS CLASSIFICATION

• Main Author: Chen, Nicholas
• Format: Final Project
• Language: Indonesia
• Online Access: https://digilib.itb.ac.id/gdl/view/76885
• Institution: Institut Teknologi Bandung

The KNN model that predicts test data using k nearest neighbors wants to be further enhanced in its performance to compete with black-box models, while still retaining the explainability characteristic of KNN. Therefore, in this final project, there are three variants of the Nearest Neighbors (NN) Model tested as alternative NN-based models with improved performance, namely: Pseudo Nearest Neighbors (PNN), Local Mean Pseudo Nearest Neighbors (LMPNN), and Multi Voter Multi Commission Nearest Neighbors (MVMCNN). Each variant of the NN model is constructed using a dataset to classify DDOS attacks. The process of building these models is inspired by the crisp-DM standard. The performance results of each model are compared using performance evaluation metrics (accuracy, recall, precision, F1-score). The results of the built models are also explained in terms of their workings using two approaches: white-box and black-box (using SHAP and LIME). These explanations are compared with the assistance of three domain experts in the field of data security through one-on-one interviews. The performance of the three variants of the NN models successfully surpasses the performance of KNN with k = 2. The interview results with domain experts indicate that the MVMCNN Model provides the best explanation results using the white-box approach. Furthermore, for explanations using the post-hoc method, both the KNN Model and the MVMCNN Model provide the best explanation results. Based on the comparison of results provided by each method to explain the NN models, the white-box approach designed has not yet surpassed the post-hoc methods (SHAP and LIME).