## 4 Results
### Evaluation of XAI Metrics  
To quantitatively evaluate the quality of model explanations, three XAI evaluation metrics were computed: the Jaccard Index, fidelity score, and stability score. These metrics provide complementary insights into the agreement between explainers, their faithfulness to the model's true decision function, and their robustness to input perturbations, respectively. Figure 9 presents a comparative summary of these metrics for the XGBoost and TabNet models.  
As shown, XGBoost consistently outperforms TabNet across all three evaluation dimensions, with higher similarity in top features (Jaccard Index = 0.82), stronger alignment between explanation and model output (fidelity = 0.91), and more stable explanations under local variations (stability = 0.89). These results indicate that the explainability techniques yield more consistent and reliable interpretations for the XGBoost model, reinforcing its interpretability advantage in this forensic analysis context.  
\begin{table}
\begin{tabular}{l c c c} \hline \hline
**Feature** & **TabNet Attention (\%)** & **SHAP Avg. Rank** & **LIME Avg. Rank** \\ \hline smean & 42 & 4 & 1 \\ ct\_srv\_dst & 38 & 2 & 2 \\ tcprtt & 55 & 3 & 3 \\ spkts & 36 & 6 & 4 \\ dbytes & 68 & 5 & 5 \\ sbytes & 71 & 1 & 6 \\ ct\_dst\_src\_ltm & 28 & 8 & 7 \\ ct\_dst\_sport\_ltm & 32 & 7 & 8 \\ sttl & 29 & 9 & 9 \\ ct\_state\_ttl & 34 & 10 & 10 \\ \hline \hline \end{tabular}
\end{table}
Table 11: Comparison of TabNet attention frequency and SHAP/LIME rankings for the features in Figure 8.  
Although TabNet has built-in explainability, it is not sufficient for forensic contexts. The presented metrics show lower stability and fidelity compared to SHAP and LIME. Therefore, it is concluded that TabNet's native explainability does not eliminate the need for external methods, especially in applications requiring legal traceability.  
Figure 9 illustrates the comparative evaluation of the three key XAI metrics the Jaccard Index, fidelity score, and stability score applied to the XGBoost and TabNet models. The results demonstrate that XGBoost consistently outperforms TabNet across all metrics.  
Specifically, the Jaccard Index value is higher for XGBoost (0.82) than for TabNet (0.65), indicating greater agreement between SHAP and LIME in identifying relevant features, and therefore higher consistency in the generated explanations. In terms of fidelity, which assesses how accurately an explanation approximates the model's original prediction, XGBoost achieves a score of 0.91, slightly above TabNet's 0.85. This suggests that the explanations generated for XGBoost are more faithful to the underlying model behavior.  
The most notable difference is observed in the stability score, which reaches 0.89 for XGBoost, compared to TabNet's 0.72. This metric reflects the robustness of explanations when small perturbations are introduced to the input data, a property of particular importance in forensic applications, where reproducibility and consistency are critical.  
These findings highlight the interpretability advantages of tree-based ensemble models (XGBoost) over deep learning architectures (TabNet) in the context of explainable intrusion detection.