## 3 Materials and Methods
### Low-Level XAI Pipeline Components
**Rationale of Choosing SHAP and LIME:** We have chosen SHAP (SHapley Additive exPlanations) and LIME (Local Interpretable Model-agnostic Explanations) frameworks for our XAI pipeline. This decision is based on the shortcomings of single-feature explainability methods like partial dependence plots (PDPs), individual conditional expectation (ICE) plots, and leave-one-column-out (LOCO). These single-feature approaches struggle to account for interactions between different features, which can compromise local accuracy. In contrast, SHAP and LIME overcome these challenges by delivering comprehensive explanations that incorporate feature interactions. Moreover, SHAP utilizes game-theoretic principles to assign importance values to features based on their contribution to predictions. This method pinpoints what influences decisions, thereby enhancing the transparency of the AI's thought process. SHAP is rooted in cooperative game theory, ensuring a consistent and equitable attribution of feature importance [59]. Conversely, LIME offers insights into individual predictions by locally simplifying the model's decision boundary, aiding users and developers in understanding why specific decisions were made. In particular, LIME clarifies individual predictions by perturbing the input data and observing how the predictions change. It constructs a locally interpretable model near the prediction to approximate the complex model's decision boundary, revealing how each feature influences the prediction on a local scale [60]. Both methods play a crucial role in increasing the accountability of AI systems, showcasing their adaptability across various industries [59; 61]. The performance of SHAP and LIME varies with the characteristics of the dataset. For example, SHAP tends to perform better with sparse data due to its inherent completeness constraint, which acts as a regularizing factor. This attribute helps stabilize the explanations that SHAP generates, leading to more consistent and reliable interpretations in such cases [62]. SHAP's foundation in well-established game theory principles provides a robust basis for its explanations, enhancing its reliability and trustworthiness [60]. Therefore, SHAP and LIME significantly enhance the interpretability of AI models, which is vital for building user trust and ensuring compliance with regulatory standards. This makes them well suited for our XAI pipeline, enabling accurate and interpretable explanations of model decisions at both the global and local levels. **Feature Explanation:** The final component in our framework is the extraction of detailed metrics from the global explanations. In particular, we extract the model-specific features (i.e., top important features for each AI model) and intrusion-specific features (i.e., top features for each intrusion type) for different classes of AI models that we have and different types of network intrusions. We also provide human-understandable explanations of the decision-making of the AI model and the related top features. **XAI Framework Algorithm:** We now provide the main steps of our XAI framework (Algorithm 1). ```
1:Load one of the network intrusion datasets (i.e., RoEduNet-SIMARGL2021, CICIDS-2017, or NSL-KDD). 2:Choose feature columns for analysis. 3:Normalize features to prepare data for modeling. 4:Train AI models on the preprocessed data (including ADA, DNN, LightGBM, SVM, MLP, RF, and KNN). 5:Test the AI models to evaluate performance. 6:Generate performance measures to assess model accuracy and reliability (accuracy, recall, F1, precision, BACC, MCC, and AUCROC). 7:For a global perspective, perform the following steps:
8:Generate Shapley values for different intrusion features to obtain global explanations of the AI model's behavior. 9:Generate SHAP Global Graphs (SHAP summary plots). 10:Extract top features that influence model decisions:
11:Extract top features specific to each AI model. 12:Extract overall top features across all models. 13:Extract top features specific to each attack type.