## 5 Discussion
### Future Work: Parameter Optimization and Dataset Balancing for Greater Reliability  
The results presented in this study highlight the potential for achieving substantial improvements in the performance of intrusion detection models through targeted parameter optimization. Initial experiments conducted with default configurations yielded relatively low macro AUC scores (0.38 for XGBoost and 0.43 for TabNet), limiting both the interpretability and forensic utility of the results.  
However, preliminary adjustments to key hyperparameters--particularly the learning_rate (learning_rate, from 0.1 to 0.05), the number of trees (n_estimators, from 100 to 300), and the L1 regularization term (reg_alpha, from unspecified to 1.0) in XGBoost, as well as the number of decision steps (n_steps, from 3 to 5), the attention dimension (n_d = n_a, from 8 to 32), and the relaxation parameter (gamma, from 1.3 to 1.5) in TabNet--led to notable performance gains. These modifications enabled a more precise tuning of the models' capacity to capture discriminative patterns in the data, especially in the presence of class imbalance. As a result, the macro AUC scores increased from 0.38 to 0.65 in XGBoost and from 0.43 to 0.66 in TabNet, demonstrating significant improvements in multiclass detection capabilities, particularly for previously under-represented classes.  
This suggests that parameter optimization can meaningfully enhance both classification performance and the reliability of model outputs. Given the wide range of possible values for each hyperparameter, future work should consider the use of systematic search strategies such as Grid Search to efficiently explore the configuration space. Parameters such as learning_rate, n_estimators, and max_depth in XGBoost, as well as n_steps, gamma, and lambda_sparse in TabNet, are especially influential and warrant detailed investigation.  
In parallel, the class imbalance observed in the UNSW-NB15 dataset remains a critical factor affecting model performance, particularly for low-frequency categories such as Worms or Shellcode. These under-represented classes consistently yielded lower AUC values, likely due to insufficient training instances. Therefore, combining hyperparameter tuning with class-balancing techniques, such as SMOTE or stratified sampling, may offer additional improvements, particularly in the detection of minority classes.  
Taken together, these findings reinforce that, with appropriate hyperparameter tuning and careful data preparation, it is indeed possible to significantly enhance the discriminative power and forensic reliability of AI-based intrusion detection models. Future experiments will focus on refining these approaches to build more robust and explainable systems that are suitable for high-stakes cybersecurity applications.  
Additionally, although a formal ablation experiment was not conducted in this study, future work should pursue a structured comparative evaluation of explainability techniques particularly SHAP and LIME within the context of intrusion detection systems (IDS). Giventheir complementary strengths, a systematic ablation study examining their individual and joint impact across key dimensions, such as explanatory fidelity, stability, Jaccard similarity, computational efficiency, and forensic relevance would yield valuable insights into their respective trade offs and operational suitability. This line of research could guide the integration of hybrid XAI strategies tailored to forensic cybersecurity applications.