## 2 Related Work  
As far as we know, there are currently no related works involving the application of XAI techniques to explain the reasoning of an RL model of classification over IDS data. Regarding other models used to classify attacks from data captured by an IDS, there are several proposals such as the following: in [6], different models for intrusion detection in an Industrial Internet of Things (IIoT) environment are explored, including tree-based models such as Decision Tree (DT) and Random Forest (RF); and Deep Neural Networks (DNN), such as Multilayer Perceptron (MLP) along with a feature selection technique using XGBoost (XGB), another tree model. The study presented in [7] focuses similarly on tree models, adding the selection of features based on a genetic algorithm and achieving different results by focusing on different DNN applications, with a reduction of the classification to five classes of the possible ten classes (nine attacks, one normal traffic) considered on the UNSW-NB15 dataset. Most of the proposals that make use of RL for an IDS use it for another purpose, such as the creation of honeypots for attack deflection [8], hyper-parameter control [9], or a multi-level multi-agent architecture [10]. The integration framework EI-XIDS [11] integrates a combination of diverse models and explainability methodologies, addressing the challenge of both the black-box nature of AI approaches to an IDS and the variance of interpretability objectives in different life-stages of an attack. It employs RL, but as a means of selection between different explainable models according to the detected scenario. We have not found any work that proposes or solves the application of explanations for an RL model in the context of threat detection. Additional researches introduce the application of XAI in the context of IDS, aiming to explore the explainability of systems [4]. Further research presented in [12] shows an architecture structured around three core components: best-model selection, selected model classification, and model explanation using the SHAP method. The best-model selection component focuses on identifying the most suitable machine learning models for the task. Several models are trained using IoT-specific IDS datasets, including IoTID20, NF-BoTIoT-v2, and NF-ToN-IoT-v2, which feature binary-class and multiclass outputs. Once the best-performing model is identified, it undergoes classification training using the previously mentioned datasets. Finally, the selected model's classifications are evaluated and explained using the SHAP method. By understanding the rationale behind the model's decisions, stakeholders can gain deeper insights into potential security threats within the IoT environment. The results presented in the paper demonstrate effective detection rates and accuracy across multiple datasets, enhancing the performance of existing methods. Notably, the use of ensemble tree models, particularly Decision Trees (DT) and Random Forests (RF), achieves 100% accuracy and Area Under the Curve (AUC) in several scenarios. The SPIP (S: Shapley Additive exPlanations, P: Permutation Feature Importance, I: Individual Conditional Expectation, P: Partial Dependence Plot) framework, proposed by [PERSON] et al. [13], aims to assess explainable Deep Learning algorithms for IDSs in IoT environments. This framework generates both local and global explanations by combining various XAI and DL methods. SPIP extracts a tailored set of input features that outperform the original feature set across three of the most widely used benchmark datasets: NSL-KDD, UNSW-NB15, and ToN_IoT. First, binary classifiers are constructed to detect attacks without specifically identifying the class of the attacks. XAI methods (SHAP and PDP) are applied to analyze the most critical features across three datasets: NSL-KDD, UNSW-NB15, and ToN_IoT. Next, one-vs-all classifiers are built to detect each class of attack separately. This approach allows for the creation of dedicated models for individual attack classes.