# Explainable AI Assisted IoMT Security in Future 6G Networks
## 6 Cross-Validation Results of XAI Methods  
This section evaluates various XAI techniques, specifically, SHAP, LIME and DiCE, using cross-validation to assess their contributions to securing healthcare application within 6G environments. The analysis emphasizes the consistency and interpretability of feature importance across different XAI methods to improve transparency, trust, and robustness in AI-driven security systems for healthcare.  
The interpretability analysis with SHAP, LIME, and DiCE offers critical insights into decision-making, enhancing the model's reliability in distinguishing normal from attack traffic. SHAP associate high system time ('scputimes_system'), user time ('scputimes_user'), and idle time ('scputimes_idle') with normal operations, whereas LIME warn that excessive idle time ('scputimes_idle') may indicate underutilization, potentially masking malicious activity, and high user time ('scputimes_user') could signal cryptojacking or resource-intensive attacks. This suggests that while CPU activity is a strong indicator of normal behavior, extreme deviations can imply anomalies. In network activity, DiCE identify source bytes ('SrcBytes') and destination bytes ('DstBytes') as indicators of normal traffic, with unusually high values signaling potential data exfiltration or flooding. Similarly, low source jitter ('SrcJitter') and destination jitter ('DstJitter') support a normal prediction, while high jitter suggests network instability or an attack, aligning with LIME' identification of unusual packet activity ('SIntPktAct') as a threat. Regarding system resource availability, LIME highlight available virtual memory ('svmem_free') and minimum packet size ('sMinPktSz') as stabilizing factors in normal predictions, complementing SHAP and DiCE, which focus more on CPU and network metrics. This cross-validation confirms that normal traffic is  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Feature** & **Full Form** & **Value 1** & **Value 2** & **Value 3** & \begin{tabular}{c} **Reason for Normal** \\ **Prediction** \\ \end{tabular} \\ \hline SrcLoad & Source Load & - & - & - & - \\  & & & & & \begin{tabular}{c} Unchanged, but its impact \\ is less significant due to \\ other feature changes. \\ \end{tabular} \\ \hline DstLoad & \begin{tabular}{c} Destination \\ Load \\ \end{tabular} & - & - & - & - \\  & & & & & \begin{tabular}{c} Similar to SrcLoad, \\ unchanged, but now less \\ relevant as other features \\ have been adjusted. \\ \end{tabular} \\ \hline SrcJitter & Source Jitter & 253.2 & 253.2 & 253.2 & 253.2 & \begin{tabular}{c} Lower jitters indicate \\ stable network conditions, \\ a key indicator of \\ normal traffic. \\ \end{tabular} \\ \hline DstJitter & \
\begin{tabular}{c} Destination \\ Jitter \\ \end{tabular} & 337.6 & 337.6 & 337.7 &
\begin{tabular}{c} Reduced jitters suggest \\ stable network \\ performance, removing \\ the erratic behavior \\ typical of attacks. \\ \end{tabular} \\ \hline \hline \end{tabular} Note: ‘-’ indicates that the values remain unchanged.  
\end{table}
Table 8: _Cont._characterized by stable CPU usage, typical network activity, and sufficient resources, while anomalies in idle time ('scputtimes_idle'), jitter ('SrcJitter', 'DstJitter'), and unusual packet behavior ('SlntPktAct') indicate potential attacks. This empirical analysis illustrates how a comprehensive, multi-faceted approach strengthens the security framework of 6G-enabled healthcare systems.  
This evaluation confirms the reliability of explainability, showing that the identified features genuinely influence model predictions, not just artifacts of a specific method. The consistency across XAI techniques reinforces the trustworthiness of AI-driven decisions in critical applications, such as 6G medical network security, strengthening confidence in the transparency and dependability of the approach.