# Explainable AI Assisted IoMT Security in Future 6G Networks
## 5 Experiments and Results
### Implementation of Explainable AI Techniques: SHAP, LIME, and DiCE
#### 5.4.3. LIME
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Features** & **Full Form** & **Interpretation** & **Reason for ’Normal’ Prediction** \\ \hline \hline \multirow{8}{*}{Packet\_num} & \multirow{8}{*}{Total Number of Packets in Flow} & Elevated packet count might suggest malicious activity like cryptojacking. & The 669 packets could indicate some background activity, but the system does not show signs of attack. The normal disk usage and low packet size (dMaxPktSz = 74) reinforce normal network behavior. \\ \hline \multirow{8}{*}{svmem\_slab} & \multirow{8}{*}{Kernel Slab Memory Usage} & High kernel slab memory usage (53817344.00) could indicate memory leaks or excessive resource consumption, triggering significant memory anomalies like buffer overflows. & Despite the higher memory usage, the overall system behavior remains normal due to low traffic volume (TotPkts = 9) and moderate disk usage (sdiskusage\_percent = 49\%). \\ \hline \multirow{8}{*}{scpustats\_ctx\_switches} & \multirow{8}{*}{CPU Context} & High context switching (14724535.00) may indicate excessive task switching due to an attack. & Even with high context switching, other features like normal packet flow and moderate disk usage override the potential attack indicators, leading to the final normal prediction. \\ \hline \multirow{8}{*}{svmem\_active} & \multirow{8}{*}{Active RAM Usage} & High RAM usage could indicate background malicious activities consuming system resources. & Though active RAM usage is high (Value = 406380544.00), the system shows low traffic (TotPkts = 9) and moderate disk usage (sdiskusage\_percent = 49\%), confirming that the behavior is typical for a regular system not under attack. \\ \hline \multirow{8}{*}{scputumes\_softirq} & \multirow{8}{*}{Endling Software Interrupts} & While the soft IRQ time is slightly higher (Value = 44.00), the system’s low packet count and normal disk usage (sdiskusage\_percent = 49\%) maintain a normal classification despite the slight indication of an attack. \\ \cline{1-1} \cline{3-3}  & \multirow{2}{*}{CPU Time} & \multirow{2}{*}{Increased soft IRQ} (Value = 44.00), the system’s low packet count and normal disk usage (sdiskusage\_percent = 49\%) maintain a normal classification despite the slight indication of an attack. \\ \cline{1-1} \cline{3-3}  & & & \\ \cline{1-1} \cline{3-3}  & & & \\ \cline{1-1} \cline{3-3}  & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 5: _Cont._
\begin{table}
\begin{tabular}{c c c c} \hline \hline
* The blue features (IMEI, DstBytes and dMaxPktSz) contribute slightly towards a benign classification, as they do not exhibit strong attack characteristics. Their presence slightly reduces the likelihood of an attack but does not override the dominant attack-related features. * The orange features dominate the decision, reflecting the abnormal CPU, memory, network, and disk behaviors commonly associated with attacks. Table 6 effectively summarizes how LIME interprets the feature contributions in determining the final prediction.