## 6 Conclusions, Discussion, and Future Work
Models trained to recognize intrusion on a system from their logs, like those used on SIEMs, could also benefit from further explaining the indicators that pushed a model to classify some behavior as critical. Further research could explore the unique challenges of applying XAI techniques in domains such as the Internet of Things (IoT) [26], where explanations need to account for and adapt to highly heterogeneous environments. Similarly, in Intelligent Connected Vehicles (ITS) [27], the focus could be on tailoring explanations to end users who are not technical administrators but are still interested in understanding potential attacks [28]. Similarly, explainability could be applied to models of app fingerprinting, where the analysis of network traffic is used--often without the user's knowledge--to identify the apps and functionalities being utilized on a device [29; 30]. Another potential application lies in optimization schemes for more secure communication, particularly in IIoT environments [31]. Both areas are closely related to cybersecurity but fall outside the scope of intrusion detection. The decisions made in these realms of cyber-defense systems need to be both immediate and verifiable. A system capable of conclusively explaining the reasons behind a model's decision could lead the admin in charge of a system to perform a faster recovery and implement a better prevention to further repeated intrusions. This research work represents a previous version of a future system that should be able to identify anomalous behavior on network traffic developed by potential insider attacks, where the output value will be part of the situational awareness of a modeling risk scenario, considering the system presented in [32]. As discussed in Section 2, different explainable techniques have been employed in Intrusion Detection Systems (IDS) to enhance their interpretability and performance. Table 1 compares the proposed approach with related works, focusing on key aspects such as the datasets used, whether the data were balanced, the XAI (Explainable Artificial Intelligence) techniques employed, the scope of explanation (local or global), and the primary use of these techniques. The comparison highlights the different approaches used for explainability, including SHAP, PFI, ICE, and LIME, and illustrates how the proposed model offers an advancement by incorporating SMOTE balancing and the introduction of semi-automatic rule proposals for the IDS improvement. Conceptualization, X.L.-N. and L.P.M. ; methodology, X.L.-N. and L.P.M. ; software, X.L.-N. and L.P.M. ; validation, X.L.-N., L.P.M. and C.S.-Z. ; formal analysis, X.L.-N.; investigation, L.P.M. ; resources, X.L.-N., V.A.V. and M.A.-C.; data curation, L.P.M. ; writing--original draft preparation, X.L.-N. and L.P.M. ; writing--review and editing, C.S.-Z., O.J., V.A.V., M.A.-C., X.L.-N. and L.P.M. ; visualization, X.L.-N. and L.P.M. ; supervision, X.L.-N. and M.A.-C.; project administration, M.A.-C. and V.A.V. ; funding acquisition, X.L.-N. and M.A.-C. All authors have read and agreed to the published version of the manuscript. This work has been partially by the National Institute of Cybersecurity from Spain (INCIBE), through the national promotional program \"Proyectos Estratgeicos de Ciberseguridad en Espana\", which falls under the Recovery Plan, Transformation and Resilience campaign, funded with Next Generation EU funds. All text data is available from the references mentioned in the manuscript. The authors declare no conflicts of interest.