## 4 Proposal  
This research article proposes a simple architecture for the computation of explicability in two levels: by the global feature importance, and by the ranges of their values. The objective is allowing the explanation of the decision-making process of a classification model so that the protection of specially valuable systems can be kept on a human-in-the-loop approach. The use of \"black-box\" models on IDSs can bring a reliable level of protection but can as well leave an organization completely in the blind towards the actors behind an intrusion and their most vulnerable points of entry. In currently deployed systems, these models have been previously studied and evaluated, but this provides little insight into their inner work, just integrating the attack predictions into the system. In our proposed architecture, both global and local explanations of the model behavior could be integrated for a better performance and a rule-based configuration of the system by the administrator user.  
The integration of explanations and interpretation on the detection performed by an IDS can allow a greater level of interaction between the predictions of the AI models used by that system, and the configuration and response performed by the operators of the network. After an initial training of a classification model over a known dataset, global explanations and the derived class feature importance can be reused to further fine-tune a model, and the explanations in a by-the-feature method can be used for the development of automatic filtering to be applied to the network IDS as rule-based controls. An abstract proposal for such an application is presented in Figure 1.  
This work was developed using the UNSW-NB15 dataset to evaluate this system for the classification and further explanation of malicious traffic. In detail, this research article evaluates a reinforced learning algorithm for multiclass classification based on Proximal Policy Optimization (PPO), using SHapley Additive exPlanations (SHAP) as an XAI technique for the post hoc explanation of the model.  
The choice of both the model and the XAI technique is not arbitrary. Based on cooperative game theory, SHAP values provide a mathematically rigorous method for assigning an output contribution to each input feature in a model, allowing both a local explanation (of a single prediction) and aglobal understanding (of model capabilities) [23]. As has been presented, this has led SHAP to be the standard de facto method used for AI explanation. However, choosing SHAP has limited the choice of the RL algorithm, since the SHAP library explainer to be used, KernelExplainer, requires a prediction function that corresponds to a probability distribution. Considering that some of the RL algorithms have a fully deterministic prediction function, this has limited the choice to two within the chosen framework: PPO or A2C, from which the first has finally been chosen.  
The development presented in this work follows the following steps:  
* Dataset Preparation: Establishment of a criterion for selecting dataset characteristics and processing of the dataset.
* Modeling and Training: Designing of the environment according to the RL philosophy, and machine learning algorithm-oriented anomaly Intrusion Detection Systems.
* Modeling Comparison: Developing a model performance comparison.
* Application of Reinforcement XAI Model: Exploration and application of XAI techniques to the RL model with the best F1-score metric.