# Explainable AI Assisted IoMT Security in Future 6G Networks
## 5 Experiments and Results
### Implementation of Explainable AI Techniques: SHAP, LIME, and DiCE
#### 5.4.2 SHAP
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Features** & **Full Form** & **Interpretation** & **Reason for ’Normal’** \\  & & & **Prediction** \\ \hline \multirow{4}{*}{**scpuptimes_**} & CPU & \multirow{2}{*}{I/O wait time is typical, reflecting normal operations waiting for data.} & Positive contribution suggests expected I/O wait time, indicating typical system conditions without anomalies. \\  & CPU & & \\  & Time & & \\  & Time & & \\  & in & & \\  & System & & \\  & Mode & & \\  & Mode & & \\  & & & \\  & & & \\  & & & \\  & CPU & & \\  & Time & & \\  & in & & \\  & System & & \\  & Mode & & \\  & Mode & & \\  & & & \\  & & & \\  & & & \\ \hline \multirow{4}{*}{**scpustats\_**} & CPU & The number of interrupts suggests normal system activity & Positive contribution indicates the system is operating under expected conditions, with no significant interruptions or failures. \\  & Hardware & & \\  & Interrupts & & \\  & Count & & \\  & Count & & \\  & & & \\  & & & \\  & & & \\ \hline \multirow{4}{*}{**scpustats\_**} & CPU & High number of context switches & Positive contribution indicates regular system activity and resource multitasking or process handling. \\  & Context & & \\  & Switches & & \\  & Count & & \\  & Count & & \\ \hline \hline \end{tabular}
\end{table} 
Table 3: _Cont._Table 4 lists the features, their interpretations, and the contributions to the model's prediction, explaining why the prediction is classified as an attack. While some features suggest normal behavior, their individual contributions are insufficient to change the decision. However, the combined influence of certain features, in context, leads to the classification of an attack, highlighting the complex interplay of feature contributions in the decision-making process. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Features** & **Full Form** & **Interpretation** &
\begin{tabular}{c} **Reason for ‘Attack’** \\ **Prediction** \\ \end{tabular} \\ \hline \multirow{4}{*}{\(\text{scputimes\_}\) idle} & & The idle CPU time alone is \\  & & The idle CPU time & not sus-picious, but the \\  & & typ-ically suggests & combination with high \\  & & benign behavior, & scpustats\_interrupts \\  & & but its impact is not & (sus-gesting system \\  & & enough to over-ride & disruption) and \\  & & the attack & scpoutimes\_user (indicating \\  & & predic-tion. & us-er-level activity) points to \\  & & & a possible attack. \\ \hline \multirow{4}{*}{\(\text{scputimes\_}\) user} & & High CPU time & scputimes\_user suggests \\  & & spent on user & active user & active user \\  & & User Mode & behavior but is not & delays) and svmem\_slab \\  & & & dominant enough & (high memory usage), points \\  & & to change the & to abnormal system behavior \\  & & classification. & typical of attacks. \\ \hline \multirow{4}{*}{\(\text{svmem\_}\) slab} & & High memory & High svmem\_slab indicates \\  & & & usage by kernel & memory manipulation, \\  & & & usage by kernel & which, combined with high \\  & & & objects can signal & scpustats\_interrupts \\  & & Memory Usage & system stress, & (potential overload), suggests \\  & & possibly due to & that the system is under \\  & & & attack activity. & attack, trying to overwhelm \\  & & & & the resources. \\ \hline \multirow{4}{*}{\(\text{scputimes\_}\) iowait} & & High I/O wait time & Elevated scputimes\_iowait \\  & & & indicates delayed I/O \\  & & & operations, possibly due to \\  & & & suggests delays, & attack-induced resource \\  & & Waiting for I/O & potentially from & contention. Combined with \\  & & Operations & attack-related & high scputés\_interrupts \\  & & & activities. & (system disruptions), this \\  & & & signals a denial-of-service or \\  & & & & resource exhaustion attack. \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Feature contributions and interpretations in SHAP force plot for network traffic classification. Figure 10: SHAP force plot for record sample 2 from test dataset (local explanation)—predicting Class 1–“Attack” traffic.