## 4 Evaluation and Performance Optimization
### Features with Model-Agnostic Analysis  
Similarly, in network intrusion detection, sensitivity attributes are used for feature selection, model interpretability in a black-box scenario, as well as robustness testing. They refer to certain features in a network dataset that could introduce bias or unfairness when building machine learning models. These features could be device information, IP address, user/device types, or time-based attributes. We explore model-agnostic analysis. It measures the decrease in model performance when a feature's values are randomly shuffled; it implicitly depicts the permuting importance characteristic, which should reduce the model's performance. The predominant model-agnostic methods in this study are partial dependence plot, LIME, SHAP, and correlation matrix. These insights are critical for improving model interpretability, feature selection, and ensuring robustness in ML models. Feature sensitivity analysis helps in interpreting feature contributions to individual predictions or general model behavior. Various methods, like partial derivatives, permutation importance, and variance-based measures can be used, depending on the type of model.  
The summary plot shows the feature importance of each feature in the model. The results show that \"duration\" and \"protocol-type\" are major factors in determining the results for CIC-IDS2019, while it is \"sequence\" and \"duration\" for 5G-NIDD. Figure 9 depicts the model decisions by mapping the cumulative SHAP values for each prediction. Each plotted line on the decision plot shows how strongly the individual features contributed to a single prediction, thus explaining the feature values that influenced the prediction of malicious (red color) or benign (blue color).  
Figure 10 presents changes in the ML model's predictions, as duration and sequence change, respectively, in the CIC-IDS2019 and 5G-NIDD datasets, while keeping all other features fixed. This is a black-box scenario for the RF and XGBoost models. This gives insight to the feature that is most sensitive, such that if it is perturbed, it would have a negative impact on the classification of traffic, and such traffic has the capability of being eva  
Figure 9: SHAP interaction—CIC-IDS2019 and 5G-NIDD, respectively.  
High correlations (Equation (3)) between certain features indicate specific behavioral patterns of network activity: packet_size, duration, and protocol revealed different correlation patterns for malicious traffic compared to benign traffic. For instance, a high correlation between duration and packet_size might indicate sustained data transfers (e.g., file uploads/downloads or data exfiltration in a cyberattack). In benign traffic, these ports (HTTP/80 and HTTPS/443) are certain to be commonly used together; their correlations, \(r\), (Figure 11) with other features may reflect normal web browsing behavior.  
\[r=\left(\frac{\Sigma(x_{i}\ -\underline{x})\Big{(}y_{i}-\underline{y}\Big{)}}{ \sqrt{\Sigma(x_{i}\ -\underline{x})^{2}\Sigma(y_{i}\ -y)^{2}}}\right) \tag{3}\]  
Figure 11: Correlation matrix.  
Figure 10: Partial dependency for CIC-IDS2019 and 5G-NIDD, respectively.  
While correlation features provide insight into the relationship pattern and possible behavioral occurrences, it is important to note that correlation interpretation does not imply that one feature causes changes in another. For instance, a high correlation between packet_size and duration does not mean large packets directly cause longer durations.