## 1 Introduction  
The primary goal of an intrusion detection system (IDS) is to identify the unauthorized use, misuse, and abuse of computer network systems by both system insiders and external penetators [1, 2]. Typically, the design of any traditional IDS is based on the belief that an intruder's behavior will be noticeably different from that of a legitimate user and that many unauthorized actions are detectable. With the exponential growth in the number of cyber-intrusions in current networked systems and the high evolution rate of such intrusions, the need to detect such malicious activities and stop related attacks inspires new research directions for developing advanced artificial intelligence (AI) techniques for IDSs [3, 4]. Numerous research works have been developed in the literature to detect intrusions, with a focus on statistical anomalies [5, 6] and rule-based misuse models [7, 8], some of which have also been deployed on an experimental basis in real-world systems [9, 10]. However, in the era of widespread cyber connectivity among heterogeneous computer networks, intrusion detection encounters numerous contemporary challenges. Intruders now possess greater access, enabling them to execute increasingly sophisticated attacks without detection [11; 12]. This scenario has prompted the exploration of AI's potential in bolstering intrusion detection capabilities within IDSs [13; 14; 15]. Various AI techniques have been employed to enhance intrusion detection, encompassing artificial neural networks [16; 17], support vector machines [18; 19], decision trees [20; 21; 22], naive Bayes [23; 24], and random forest [25; 26; 27]. While prior AI-based approaches for IDSs have acknowledged the influence of individual features on AI decision-making, they often overlook the intricacies of attack-specific feature relevance or the utilization of these features to enhance global and local explanations of AI methods within IDSs. In particular, earlier research has primarily concentrated on the classification accuracy of different AI algorithms, without offering insights into their underlying behavior and decision-making processes. Moreover, they have not explored the importance of attack-specific features, the integration of global and local explanations, or the examination of diverse intrusion datasets and AI model sets. These constraints highlight the urgent need to utilize the relatively new domain of explainable AI (XAI) to enhance the clarity of AI decisions in IDSs [28]. Moreover, other prior works have discussed the proliferation of network threats and cyber-attacks in recent years and emphasized the need for the development of sophisticated IDSs capable of not only detecting but also effectively mitigating such threats [29; 30]. Additionally, the integration of deep learning techniques into IDSs has shown promising results in real-time anomaly detection for IoT and SCADA infrastructures [31; 32]. This diversified foundation further supports this study's exploration of XAI within network IDSs. The XAI field offers two primary advantages when applied to contemporary IDSs. Firstly, it fosters trust between the AI agent and the human security agent, which holds paramount importance in high-risk domains such as IDSs. By substantiating AI predictions with evidence, XAI establishes trust with security domain experts. Secondly, XAI enhances transparency by enabling analysts to comprehend why and how the model operates. This demystifies network intrusion detection, particularly in the context of black-box systems. However, it is important to note that the efficacy of this second benefit relies heavily on the quality of the data and their labeling. For instance, if the network intrusion data used to train the model are poorly labeled, it will inevitably impact the performance of black-box XAI methods. In this paper, we propose an end-to-end XAI framework, termed XAI-IDS, designed to enhance explainability in IDSs.