## 3 Materials and Methods
### Explainable AI Methodology for Forensic Intrusion Detection
#### 3.1.3 Prediction and Explanation Models: LIME and SHAP  
This work combines a high-performing classifier with complementary explainability techniques to support forensic analysis. XGBoost, a gradient-boosted tree ensemble, is used for multiclass traffic prediction due to its robustness and efficiency on structured data. To interpret the model's decisions, we integrate two widely adopted XAI methods: LIME, which generates local surrogate explanations, and SHAP, which assigns feature attributions grounded in game theory. Together, these components provide both predictive power and interpretable insights essential for transparent and legally defensible outcomes. LIME is a model-agnostic technique that is widely adopted for interpreting the decisions of black-box classifiers. It works by generating a synthetic dataset composed of perturbed instances derived from the original input, along with the corresponding predictions obtained from the target model. An interpretable surrogate model is then trained on this local neighborhood, assigning higher weights to instances closer to the observation of interest. This surrogate model provides a localized, linear approximation of the decision boundary, enabling the analysis of individual feature contributions. The primary objective of LIME is to construct a locally faithful approximation that reveals the most influential features affecting the model's decision in a given context. This local interpretability makes it particularly suitable for forensic applications, where transparency and case-specific explanations are critical. LIME explains a prediction \(f(x)\) by approximating it locally with an interpretable model \(g(z)\), which is typically linear, trained on a perturbed sample space \(Z\) around \(x\). The optimization objective is  
\[\xi(x)=argmin_{g\in G}\ \mathcal{L}(f,g,\pi_{x})+\Omega(g) \tag{1}\]  
where \(\mathcal{L}\) is a loss function measuring the fidelity of \(g\) to \(f\) under the locality distribution \(\pi_{x}\), and \(\Omega(g)\) penalizes complexity. LIME thus produces locally faithful explanations that are especially useful in justifying individual IDS alerts. Recent studies have demonstrated LIME's utility in producing actionable explanations across various domains, including healthcare and cybersecurity [25; 26]. Enhancements in computational efficiency and scalability have further increased its applicability to large-scale datasets [27; 28]. Furthermore, its flexibility in supporting different interpretable model types, such as decision trees or Lasso regression, has broadened its adoption [29]. On the other hand, SHAP is a model-agnostic technique designed to interpret the prediction of a specific instance \(x\) by assigning an importance value to each input feature. This method is grounded in cooperative game theory, specifically in the concept of Shapley values [30]. In this framework, features are considered as \"players\" in a cooperative game, and the model's output represents the \"payout\" to be fairly distributed among them. Shapley values thus quantify the average marginal contribution of each feature across all possible feature combinations, ensuring theoretically consistent and equitable allocation [31]. SHAP is grounded in cooperative game theory, computing the contribution of each feature \(i\) to a model prediction \(f(x)\) using the Shapley value:  
\[\phi_{i}=\sum_{S\subseteq F\backslash\{i\}}\frac{|S|t(|F|-|S|-1)!}{|F|!}[f(S \cup\{i\})-f(S)] \tag{2}\]  
where \(F\) is the full set of features, and \(S\) is a subset not containing \(i\). SHAP ensures consistency, local accuracy, and additive feature attribution, making it ideal for forensic applications where interpretability must be both complete and legally defensible. One of SHAP's core advantages is its capacity to provide both local and global interpretability. Locally, it explains a single prediction by identifying the features that most influenced that specific output.