## 3 Materials and Methods
### Low-Level XAI Pipeline Components
**Black-box AI Models:** After preprocessing the data, we move on to training the AI models. We divide the data into training and testing sets, with 70% used for training and 30% set aside for testing. During this phase, we utilize seven popular AI classification models: 1. RF; 2. DNN; 3. AdaBoost; 4. MLP; 5. KNN; 6. SVM; 7. LightGBM. These models were selected for their popularity and effectiveness in intrusion detection tasks. Random forests and KNN, which are frequently thought to be interpretable in machine learning, also have interpretability issues. Random forests' ensemble nature leads to complicated decision processes that go beyond single-tree clarity [56]. In low-dimensional spaces, KNN's simplicity contrasts with interpretability concerns in high-dimensional spaces, where defining the \"nearest\" neighbor becomes unclear [57]. These examples highlight the importance of sophisticated explainability approaches (such as the XAI methods considered in this work), even for models that are typically thought to be transparent. Moreover, simple decision trees that have a depth lower than five, for example, and contain a few leaves can be used as an explainability tool, as shown in prior works [20; 21; 22]. Since each level of the tree has a clear rule for each node until it reaches a leaf, it shows the model's exact decision process behind every decision. Such an approach is simple to follow and has improved explainability when compared to black-box AI models. However, this comes with much lower performance in terms of accuracy, recall, and precision. For training each model, we configure specific parameters to optimize performance. The detailed settings for each model are presented in Section 4, ensuring that the models are fine-tuned to achieve the best possible performance. **Black-box AI Evaluation:** Following model training, the next phase of our framework involves evaluating the performance of each model on unseen test data. For performance analysis, we utilize the following metrics, derived from confusion matrices generated for each model: accuracy (Acc); precision (Prec); recall (Rec); F1 score (F1); Matthews correlation coefficient (Mcc) [58]; balanced accuracy (Bacc); area under the ROC curve (AucRoc). These metrics were chosen based on their widespread usage in similar works focusing on intrusion detection systems (IDSs) [34; 35; 36]. Additionally, they allow us to examine the impact of XAI-based feature selection on model performance, enabling comparisons with prior studies on the considered datasets [34; 35; 36]. Moreover, we report training and classification times for each AI model, providing insights into computational efficiency alongside performance metrics. **XAI Global Explanations:** The aforementioned AI models are considered black-box AI models. Thus, it is essential to provide explanations of such models and accompanied features (traffic log parameters) and labels (attack types). Thus, the next step in our framework is the XAI step. In the first part of this step, we generate global importance values for all features, where we generate different graphs to analyze the impact of each feature on the AI model's decision, which can help in generating expectations about the model's behavior. We utilize different SHAP graphs for global explanations [50], which provide the average marginal contribution of each feature value over all possible coalitions, where a coalition is defined as a combination of features that are used to estimate the Shapley value of a specific feature. **XAI Local Explanations:** Our framework consists of two local XAI blocks. First, we use the recent well-known Local Interpretable Model-agnostic Explanations (LIME) [51] to gain insight into what happens inside an AI algorithm by capturing feature interactions. We first generate a model that approximates the original model locally (LIME surrogate model) and then generate the LIME local explanations. Second, we leverage SHAP [50] by generating SHAP local graphs (named waterfall graphs).