## 5 Related Work  
This section provides an overview of existing efforts in leveraging explainable artificial intelligence (XAI) for intrusion detection systems (IDSs), highlighting the distinctions between our work and previous research, as summarized in Table 20.  
**Overview of Prior Works:** The surveys conducted by [70; 71] offer a comprehensive examination of ongoing endeavors aimed at developing explainable AI-based intrusion detection systems (XAI-IDS), accompanied by a taxonomy for standardizing concepts. This survey delineates between black-box models (opaque models) and white-box models (transparent models), analyzing their trade-offs in terms of explainability and performance. Several recent studies have explored the application of XAI techniques in IDSs [72; 73; 74; 75]. For example, ref. [72] utilized decision tree algorithms to extract rules in an IDS using the KDD dataset. In another work, ref. [73] incorporated LIME to provide local explanations for an SVM model in an IDS. Similarly, ref. [74] integrated the CIA principle to enhance the explainability of AI models using the CICIDS-2017 dataset. In addition, the landscape of intrusion detection in IoT and cloud computing is replete with diverse challenges and innovative solutions. The work presented in [29] discusses the deployment of bio-inspired algorithms for feature selection, significantly enhancing the predictive accuracy of the IDS; however, they highlight the inherent complexities and computational demands that these techniques introduce. The work in [76] surveys several XAI techniques, such as SHAP and LIME, and their applications and challenges in healthcare, such as the complexity of medical data and the critical need for accurate interpretations. Furthermore, the IDS frameworks in [77; 78] illustrate successful adaptation in applying an IDS and XAI to the autonomous vehicle area. They emphasize the need for XAI to provide clarity on AI decisions, enhancing security measures against cyber threats. On the other hand, the works in [29; 31; 32] propose frameworks to enhance IDSs in the context of IoT and SCADA Systems. It is also worth mentioning [29; 30; 79], which do the same for network intrusion detection, leveraging ensemble learning and neural network applications. The authors of [80] focused on identifying DNS over HTTPS (DoH), a protocol that encrypts DNS queries to enhance privacy but poses challenges for network administrators in detecting malicious activities. It also applies SHAP to explain its results. These referenced works show the advancements and obstacles in the field, thus setting the stage for addressing these gaps through the proposed framework. **Comparison with Our Work:** While previous efforts in XAI for IDSs are commendable, our research distinguishes itself in several key aspects. Unlike existing studies, which often focus on individual XAI techniques or specific datasets, our project introduces an integrated end-to-end XAI framework explicitly crafted for network intrusion detection. We perform detailed evaluations of multiple black-box AI models, examine the effects of feature selection, and offer comprehensive insights into the importance of features for different attack types. Additionally, we present a comparative analysis of various XAI methodologies, such as SHAP and LIME, to demonstrate their effectiveness in explaining the decision-making processes of AI models used in IDSs. This research introduces a novel approach to intrusion detection that is distinctly advanced beyond previous contributions and addresses the limitations observed in the referenced studies.