## 3 Materials and Methods
### Explainable AI Methodology for Forensic Intrusion Detection
#### 3.1.3 Prediction and Explanation Models: LIME and SHAP
Globally, it aggregates these values across the dataset to offer insights into overall model behavior and feature-importance trends. This dual capability makes SHAP highly suitable for domains where explainability and auditability are critical, such as cybersecurity and digital forensics. These properties, along with efficiency, ensure that SHAP provides the most theoretically grounded method for feature attribution [25]. Unlike alternative techniques such as LIME, which relies on local linear approximations, SHAP is built on solid theoretical guarantees, particularly completeness and consistency [32; 33]. Recent studies have further confirmed SHAP's applicability and reliability in high-stakes environments like finance and healthcare, where trust and transparency in AI systems are essential [34; 35]. The efficiency property, unique to Shapley values and SHAP, guarantees the fair distribution of the model output among the features of an instance. This ensures that SHAP is the only known method capable of delivering complete and consistent explanations--an essential requirement in legally regulated domains [2]. By adhering to these principles, SHAP satisfies key regulatory expectations for AI transparency and positions itself as a critical component in the development of ethically aligned AI systems [36; 37]. Finally, LIME and SHAP are complementary approaches for explaining the decisions of complex machine learning models. While LIME provides fast, localized insights through linear surrogates, SHAP offers both global and local perspectives rooted in rigorous theoretical foundations, albeit with higher computational costs. The SHAP/LIME analysis phase focuses on generating interpretability by computing feature contributions and visualizing decision structures. In the subsequent insights phase, these outputs are leveraged to identify key variables, optimize predictive performance, and justify decisions to stakeholders. This structured process underscores the importance of XAI in ensuring model reliability, accountability, and usability in real-world applications. To visually illustrate the conceptual and methodological differences between LIME and SHAP, Figure 2 contrasts their interpretability characteristics. This is a general representation intended to demonstrate the typical behavior of each model explanation approach over a two-feature input space. Figure 2 provides a conceptual visualization of how LIME and SHAP generate explanations over a simplified two-feature input space (Feature A and Feature B). These features represent any pair of attributes extracted from the UNSW-NB15 dataset used in the classification of benign versus malicious network flows. On the left, LIME represents a localized approach using linear surrogate models over perturbed input spaces, which provides intuitive but potentially unstable explanations. On the right, SHAP leverages Shapley values to offer globally consistent and theoretically grounded attributions, ensuring completeness  
and robustness. This visual aid supports the comparative analysis by highlighting their respective scopes, mathematical foundations, and suitability in forensic interpretability scenarios. Both techniques significantly enhance the transparency and interpretability of model behavior. Table 7 presents a comparative summary of these two methods. The table highlights key differences in theoretical guarantees, interpretability scope, interaction awareness, and applicability to various analytical scenarios. These distinctions underscore the complementary nature of LIME and SHAP, particularly in forensic contexts, where explanation fidelity, stability, and legal defensibility are critical.