## 3 Materials and Methods
### Feature Importance for Different Attacks
#### Illustrations of Local Explanations by XAI  
We now provide two illustrative examples of XAI local explanations. **Local Explanation Using LIME:** Figure 2 shows an example of a local explanation of a Port Scan attack sample using LIME for random forest applied to the RoEduNet-SIMARGL2021 database. There are three vertical bars, one for each possible class. These bars contain the top five features with the greatest contributions to this outcome, where the contributions can be seen as five horizontal bars that go toward one classification or another. Here, intrusion features that push the prediction probability toward a specific class (for example, toward Port Scanning) are deemed to contribute positively (i.e., these features are assigned positive contribution values, represented by the bars that are positioned on the right-hand side). On the other hand, those that push the explanation away from the class are considered to contribute negatively (i.e., features that are assigned negative contribution values, represented by the bars that are positioned on the left-hand side) to the Port Scanning classification. The contribution of each feature is shown in Figure 2 by the horizontal bar positioned below each possible label. Moreover, the prediction probabilities field (top left) shows how much confidence LIME has in its classification, ranging from zero to one. Lastly, the green box shows the actual value for each feature in this particular instance. Based on the observations provided by LIME, an analyst could see which features contributed the most to a certain prediction and also check the confidence score. For example, it could be the case that LIME has prediction scores of 50% for port scanning, 40% for DoS, and 10% for normal traffic. In this case, the security analyst can check for port scanning and DoS since they have close scores. **Local Explanations using SHAP:** Figure 3 provides an insightful local explanation for a DoS (Denial of Service) instance using SHAP applied to a random forest model. This illustration, structured as a waterfall graph, effectively ranks the most crucial features influencing the model's decision for a specific data sample. The features are listed in descending order of impact, offering a detailed view of their contributions. One important key to this explanation is the concept of a \"base value\", which, in this context, stands at 0.334. From this baseline, the graph showcases how each feature's value (depicted in gray) either steers the model's decision toward classifying the instance as a DoS attack or away from this classification. The arrows stem from this base value and are pivotal in understanding SHAP's output. They quantitatively indicate the extent to which each feature influences the model's verdict. Features that nudge the prediction toward identifying the instance as DoS are illustrated with arrows extending left from the base value. These are shown in pink and are interpreted as having a positive contribution. Conversely, features that push the decision away from a DoS classification and, thus, potentially toward a non-DoS category extend right from the base value, depicted in blue, indicating a negative contribution. To summarize, each feature's contribution is quantified using SHAP in such a way that the evaluation can determine its contribution to deciding in favor of or against the classification of DoS. Specifically, as shown in Figure 3, features that push the forecast toward DoS (i.e., the right-hand side of the base value with the color magenta) have a positive effect, while those that push the prediction away (i.e., the left-hand side of the base value with the color blue) have a negative effect. This derives explanations for why this sample was classified as a DoS attack. Figure 2: An example of a local explanation of an RF model using LIME on a port scanning attack on the RoEduNet-SIMARGL2021 dataset.