## 6 Conclusions, Discussion, and Future Work  
Given the methodology used in this work, it can be determined that the use of RL as a classifier is not optimal. Compared to other solutions, it has a clearly lower performance. In this regard, the model with the best metrics and the one that is recommended is XGBoost. However, it is not ruled out that a more in-depth study of the design of the environment, the optimization of parameters, the evaluation of other algorithms, or the application of explanations for performance improvement (as was presented in some related works) may result in a model with superior results. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Feature** & **Type** & **Values** \\ \hline Proto & Nominal & From UDP / TCP \\ Sttl & Numerical & \textless{}63.75 \\ Ct\_srv\_dst & Numerical & \textgreater{}16.25 \\ Service & Nominal & Yes None/HTTP No DNS \\ Dmean & Numerical & \textless{}362.75 \\ Ct\_dst\_src\_ltm & Numerical & \textgreater{}17.00 \& \textless{}49.00 \\ Ct\_srv\_src & Numerical & \textgreater{}16.50 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Analysis attributes. Figure 6: Global explanation with the 10 characteristics with the most impact on the model. Nominal characteristics aggregated. Regarding XAI, it has been seen that the use of the default SHAP is useful to give basic notions about the behavior of the model, but if more precise information is required, such as in the context of an IDS, additional functionalities like the ones proposed here need to be developed. Even so, the proposed methodology has its limitations, namely mainly the absence of a unified process for numeric and nominal columns when constructing the ranges. It is hoped that in the future this limitation can be alleviated by automating the distinction between column types and applying the methodology to all characteristics (in this work it has only been applied to those present in the graphical explanation), in addition to possible improvements, such as a process of searching for valid ranges in the case where they are not found in the first place. Concerning other works, the main use of XAI has been focused on its application within the context where the model is deployed, rather than improving its performance. The explainable model is the key component of this proposal in order to obtain the evaluation of the attributes by class analysis in order to validate the detection of possible attacks. The validation and interpretation that this model offers is fundamental for a proper use of automated detection on intrusion detection systems, even more so if a dynamic integration of possible controls and courses of action is to be considered in order to defend a system against the detected intrusion. This component can be updated and improved the most using real tools such as systems like Zeek (formerly Bro-IDS), which can obtain real-world information from a network point by classifying the various characteristics necessary for the system's operation. Furthermore, the explainable model can be explored using algorithms and modules based on SPARK [4] technology for data streaming to provide real-time explanations calculating the SHAP values based on Spark script, thus improving the performance of the system. Finally, to improve the system, two options are worth considering: (1) implementing an anomaly alarm system with real-time user notifications; (2) focusing on the existing machine learning models by improving the data-clearing process. This data cleaning would specifically target boosting the True Positive Rate (TPR) metric in multiclass classification, ultimately reducing false alarms. Additionally, training these models with a combination of diverse datasets would enhance their ability to identify a wider range of attacks and anomalous traffic, leading to a more robust and secure Intrusion Detection System (IDS). Moreover, this same explainability method could be applied to further classifications over malicious data.