# Explainable AI Assisted IoMT Security in Future 6G Networks
## 5 Experiments and Results
### Implementation of Explainable AI Techniques: SHAP, LIME, and DiCE
#### 5.4.4 DiCE--Local Behavior Analysis  
The DiCE is illustrated in Figure 13, where the top row displays the original sample with a prediction of '1' (indicating \"Attack\"). The bottom row presents three counterfactual scenarios, each with a prediction of '0' (indicating \"Normal\"). From this, the following conclusions can be drawn:  
* The combination of high traffic volume (SrcBytes, DstBytes), elevated system load (SrcLoad, DstLoad), and network instability (SrcJitter, DstJitter) indicates an anomalous network condition. These feature values typically suggest an ongoing attack, such as a DDoS attack, characterized by excessive data flow and network disruptions. * The counterfactual examples state \"normal\" traffic due to significant reductions in traffic volume and jitter. Lower values for SrcBytes and DstBytes indicate typical network behavior with normal data flow, while the reduced SrcJitter and DstJitter suggest stable network conditions, which are characteristics of non-attack traffic patterns. * Some values are marked with '-', indicating that these features were not altered in the counterfactual examples. Table 7 shows the features identified via DiCE that contribute to the attack prediction, highlighting their influence on the model's decision. It details how changes in feature \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Feature** & **Full Form** & **Interpretation** & **Reason for ‘Attack’ Prediction** \\ \hline  & & & \begin{tabular}{c} scputiumes\_softirq = 730 suggests \\ an elevated level of CPU time \\ spent handling software \\ \end{tabular} & \begin{tabular}{c} CPU Time Spent \\ finding Software \\ Interrupts \\ \end{tabular} & \begin{tabular}{c} High soft IRQ \\ processing could be a \\ sign of a DDoS or \\ other attack-related \\ disruptions. \\ \end{tabular} & \begin{tabular}{c} scputiumes\_softirq = 730 suggests \\ an elevated level of CPU time \\ spent handling software \\ interrupts. When combined with \\ a high number of CPU interrupts \\ (350803317), high memory usage \\ (2488467701), and network load \\ (16832.97), it strongly suggests \\ that the system is under attack, \\ pushing the final prediction \\ towards attack. \\ \end{tabular} \\ \hline network\_load & Network Load & \begin{tabular}{c} High network load \\ suggests unusual \\ traffic patterns, \\ commonly seen in \\ attacks. \\ \end{tabular} & \begin{tabular}{c} network\_load = 16832.97 \\ indicates high network traffic, \\ reinforcing the attack \\ classification when combined \\ with other abnormal features. \\ \end{tabular} \\ \hline sdiskusage\_presetched & Percentage of Disk & \
\begin{tabular}{c} High disk usage may \\ indicate resource \\ exhaustion, often \\ used in attack \\ strategies. \\ \end{tabular} &
\begin{tabular}{c} sdiskusage\_used = 51847172511 \\ shows abnormal disk usage, \\ which, combined with a high \\ number of CPU interrupts \\ (350803317), points to an attack. \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 6: _Cont._  
Figure 13: DiCE visualization of feature values and counterfactual instances. values affect the classification, offering insights into the factors driving the shift from normal to attack behavior. Table 8 presents the features identified via DiCE and their counterfactual values that shift the prediction from attack to normal. It highlights the key features influencing the model's decision and shows the necessary changes to alter the classification outcome, providing insights into the decision boundaries of the predictive model.