## 4 Results  
We proceed to present our detailed evaluation results, aiming to address several key questions: (1) What is the performance of black-box AI models on the three considered network intrusion datasets? (2) How does XAI help in understanding and explaining the performance of different AI models for intrusion detection? (3) What are the main features for each AI model? (4) What are the main features for each intrusion type? (5) What are the common influential intrusion features among different types of AI models? (6) What is the time overhead of generating XAI explanations? and (7) How does XAI-based feature selection compare to that in baseline methods? \begin{table}
\begin{tabular}{c l l l} \hline \hline
**Feature** & **CICIDS-2017** & **RoEduNet-SIMARG12021** & **NSL-KDD** \\ \hline
1 & Destination Port & TCP\_WIN\_MSS\_IN & dst\_host\_same\_srv\_rate \\
2 & Init\_Win\_Bytes\_Backward & TCP\_WIN\_SCALE\_IN & dst\_host\_srv\_count \\
3 & Packet Length Std & TCP\_WIN\_MAX\_IN & dst\_host\_same\_src\_port\_rate \\
4 & Bwd Packet Length Mean & TCP\_WIN\_MIN\_IN & logged\_in \\
5 & Total length of Bwd Packets & TCP\_WIN\_WIN\_OUT & dst\_host\_error\_rate \\
6 & Packet Length Mean & TCP\_FLAGS & count \\
7 & Subflow Backward Bytes & PROTOCOL & srv\_count \\
8 & Packet Length Variance & FLOW\_DURAITON\_MILLISECONDS & dst\_host\_error\_rate \\ \hline \hline \end{tabular}
\end{table} 
Table 4: An overall ranking of feature importance (in descending order) across all AI models for the RoEduNet-SIMARG12021, CICIDS-2017, and NSL-KDD datasets. \begin{table}
\begin{tabular}{l l} \hline \hline
**CICIDS-2017 Features** & **Explanation** \\ \hline Packet Length Std & Standard deviation length of a packet \\ Total Length of Bwd Packets & Total size of a packet in the backward direction \\ Subflow Bwd Bytes & Average number of bytes in a backward subflow \\ Destination Port & Destination Port Address \\ Packet Length Variance & Variance length of a packet \\ Bwd Packet Length Mean & Mean size of a packet in the backward direction \\ Avg Bwd Segment Size & Average size observed in the backward direction \\ Bwd Packet Length Max & Maximum size of a packet in the backward direction \\ Init\_Win\_Bytes\_Backward & Total number of bytes in the initial backward window \\ Total Length of Fwd Packets & Total packets in the forward direction \\ Subflow Fwd Bytes & Average number of bytes in a forward subflow \\ Init\_Win\_Bytes\_Forward & Total number of bytes in the initial forward window \\ Average Packet Size & Average size of a packet \\ Packet Length Mean & Mean length of a packet \\ Max Packet Length & Maximum length of a packet \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Description of the main features for the CICIDS-2017 dataset [64]. \begin{table}
\begin{tabular}{l l} \hline \hline
**NSL-KDD Features** & **Explanation** \\ \hline duration & Length of the connection \\ protocol\_type & Type of protocol (e.g., TCP, UDP) \\ service & Network service on the destination (e.g., HTTP, FTP) \\ flag & Normal or error status of the connection \\ src\_bytes & Number of data bytes from the source to the destination \\ dst\_bytes & Number of data bytes from the destination to the source \\ logged\_in & 1 if successfully logged in; 0 otherwise \\ count & Number of connections to the same host as the current connection in the \\  & past two seconds \\ srv\_count & Number of connections to the same service as the current connection in \\  & the past two seconds \\ dst\_host\_same\_srv\_rate & Rate of connection to the same service on the destination host \\ dst\_host\_srv\_count & Count of connections to the same service on the destination host \\ dst\_host\_same\_src\_port\_rate & Rate of connections to same source port on the destination host \\ dst\_host\_server\_rate & Rate of connections that have activation flags indicating various types of \\  & errors \\ dst\_host\_error\_rate & Rate of connections that have REJ (rejected) flags \\ \hline \hline \end{tabular}
\end{table}