Uncovering Malicious Activity: Interpretable Web Log Analysis with XAI, SHAP, and LLM

This research introduces an offline method for detecting malicious web traffic using XAI for interpretability. By analyzing web server access logs, malicious activities are identified through a two-tiered classification approach. The first tier, called the string based model extracts a subset of features using an embedding model. It combines these with additional features derived from individual web requests to classify them as malicious or benign. The second tier, called the integrated model aggregates features at the IP level, such as request rates and the malicious probability derived from the first tier, to detect broader temporal patterns and coordinated attack behaviors. For interpretability, SHAP (Shapley Additive exPlanations) values highlight the most significant features influencing classifications. To enhance interpretability, these SHAP values are translated into natural language explanations using an LLM offering human-readable insights into the model’s decisions.