## 4 Results
### Evaluation Results
LightGBM's underperformance, particularly in dealing with DoS and PortScan attacks in the RoEduNet-SIMARGL2021 dataset, further stresses the challenges some models face with specific types of attacks or dataset characteristics. The disparities in model performance across various datasets and attack types show an opportunity to combine their strengths depending on the scenario or context, probably leading to an ensemble learning application in future research. Nonetheless, RF showed great consistency among all datasets, being among the top performers, especially in the NSL-KDD scenario, where it outperforms the other models by a considerable margin, except in Probe and R2L attacks. **Overall Feature Importance across different AI Models based on XAI:** We emphasize that such attack-type performance results do not give more insights into the impact of different features on the decisions of the AI models, which we present in our next experiments. **Enhancement of Explanation of AI Decision-Making in XAI-IDS:** We first show that our framework provides a human-understandable explanation to the human security analyst for the decision-making of the AI model. On the other hand, black-box AI models do not provide any justification for their decision-making. Figure 4 shows an example from the RoEduNet-SIMARGL2021 dataset. Appendix D shows different examples (explanations) for all datasets. Note that we do not produce the explanations in Figure 4 using an automated code. However, one possible future extension in this direction is to use generative AI to generate such explanations automatically given the used XAI tool (SHAP or LIME), a network traffic sample, and the output from the XAI tool (top features and their contributions). We emphasize that the raw input features in the top part of Figure 4 are not user-friendly for the average user. Hence, in a future development phase, they could be parameterized as features that can be accessed by advanced users or used if further investigation is needed. Another reason for the current layout of Figure 4 is to exemplify the benefits of adding an XAI technique. On the left-hand side is the limited information that black-box AI can provide, which is the probability of the classification outcomes. However, when combined with the XAI technique, we can provide the rule extraction from each class, the contribution from each class to a given outcome, and the list of the top most influential features with their numerical contribution scores. This added value can help non-expert or new security analysts, who could benefit from such explanations. **The Importance of Features via Explainable AI:** In this section, we demonstrate the crucial features that influence the decision-making of each AI model used in our study across the three analyzed network intrusion datasets. **(a)**: **Global Summary Plot:** We display global summary plots for various AI models, illustrating the most impactful features in the decision-making process of the models. These plots prioritize the importance of features from the most to the least influential. Figures 5 and 6 reveal the feature importance for different AI models within the RoEduNet-SIMARGL2021 and CICIDS-2017 datasets, respectively. Moreover, the global summary plot for the NSL-KDD dataset is detailed in Figure A6 in Appendix E. The importance of each feature is determined by averaging the mean Shapley values across all features. Notably, these plots also highlight the significance of different features across various attack types, represented by distinct colors for each attack label. **Interpretation of Global Summary Plots:** Figures 5 and 6 provide insights from the SHAP global explanations. These visual representations represent attacks as stacked horizontal bars, where the length of each bar reflects the magnitude of its SHAP score or its contribution to the model's predictions. Each row in these graphs corresponds to a specific feature and is ranked by the importance of the feature.