## 3 Materials and Methods
### Explainable AI Methodology for Forensic Intrusion Detection
#### 3.1.2 Model Architectures: XGBoost and TabNet  
This section briefly introduces the two models employed in this study. XGBoost is a gradient-boosted tree ensemble algorithm known for its efficiency on structured data. TabNet, in contrast, is a neural network architecture that uses attention and sparsity to perform feature selection and capture complex interactions. Both were selected for their strong performance and complementary interpretability characteristics. In this study, two advanced machine learning models, XGBoost and TabNet, were integrated to enhance the detection and interpretation of cyber threats embedded in network traffic. Each model was selected based on its unique capabilities in handling structured data, enabling interpretability, and delivering robust classification performance within the cybersecurity domain.  
XGBoost was selected due to its demonstrated efficacy in classification tasks within cybersecurity and anomaly-detection domains [23]. As a scalable and efficient gradient-boosting framework, it is particularly well suited for modeling structured data and capturing nonlinear interactions among features. The algorithm incorporates advanced regularization mechanisms (L1 and L2) and optimized tree construction techniques, which contribute to improved generalization performance and a reduced risk of overfitting. Moreover, XGBoost offers native compatibility with post hoc explainability tools such as SHAP and LIME, enabling transparent interpretation of model predictions, an essential requirement for intrusion detection systems operating in forensic or security-sensitive contexts.  
Complementing this, TabNet is a deep learning architecture specifically designed for modeling tabular data, incorporating sequential attention and sparse feature selection mechanisms to identify and prioritize the most relevant attributes during training [24].  
This architecture achieves a balance between high predictive performance and intrinsic interpretability, an essential property for applications in cybersecurity and intrusion detection systems. Unlike conventional deep neural networks, which often operate as opaque black-box models, TabNet enables native explainability by design. Its built-in interpretability capabilities make it a strong complement to post hoc analysis techniques such as SHAP and LIME, providing transparent insights into model behavior at both global and instance levels.  
In the context of this research, TabNet is employed to detect sophisticated attack patterns embedded in network traffic. Its sequential decision-making process and feature sparsity not only enhance classification accuracy, but also contribute to model robustness and transparency. The method uses the configuration employed for training the TabNet classifier to ensure consistent evaluation and fair comparison across models.  
By integrating XGBoost and TabNet, this study leverages the complementary strengths of gradient boosting and deep learning with interpretability, thus aligning with the operational needs of modern intrusion detection systems, where performance, transparency, and forensic utility are paramount.