## 3 Materials and Methods
### Data-Processing Pipeline  
The UNSW-NB15 dataset was selected due to its comprehensive representation of contemporary cyber threats, making it a widely accepted benchmark for evaluating intrusion detection systems. Recent studies have validated its effectiveness in cybersecurity research involving machine learning approaches [43]. The dataset comprises 175,341 distinct network traffic records, with each instance labeled according to one of the following defined attack categories: Fuzzers, Analysis, Backdoors, DoS, Exploits, Generic, Reconnaissance, Shellcode, and Worms. Prior to model training, input features underwent a structured preprocessing pipeline. Categorical variables, such as protocol and state, were numerically encoded; ordinal encoding was used for XGBoost, while TabNet handled embeddings internally. Continuous features were normalized using min-max scaling to ensure proportional influence across the models. Features deemed non-informative or as having high cardinality, such as IP addresses and port numbers, were excluded to reduce noise and improve model interpretability. This configuration reflects commonly accepted best practices in cybersecurity applications of XGBoost, balancing predictive performance, regularization, and explainability for robust intrusion detection modeling [44]. Regarding feature normalization, only numerical attributes were subjected to min-max scaling within the [0, 1] range. Categorical features, when present, were first transformed using one-hot encoding, resulting in binary indicator variables. Due to their discrete and bounded nature, these encoded variables were not further scaled. This distinction ensured that normalization preserved the semantic \begin{table}
\begin{tabular}{l l l} \hline \hline
**Technique** & **Parameter** & **Value** \\ \hline \multirow{4}{*}{SHAP (KernelExplainer)} & N\({}^{\circ}\) of samples per instance & 100 \\  & Background dataset & 100 random instances from the training set \\  & Link function & Identity \\  & Perturbation distribution & Independent feature permutation \\ \hline \multirow{4}{*}{LIME (TabularExplainer)} & Number of perturbed samples & 5000 \\  & Kernel width & 0.75 \\ \cline{1-1}  & Distance metric & Euclidean \\ \cline{1-1}  & Feature selection & Top 10 by weight \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Parameter settings used in SHAP and LIME for model explainability. structure of both numerical and categorical attributes without introducing distortions in interpretability or model behavior. Table 10 summarizes the applied preprocessing techniques by stage. To ensure robust model evaluation, the dataset was partitioned following standard practices: 70% for training, 20% for validation, and 10% for testing [45]. In addition, care was taken to ensure that the distribution of attack categories was proportionally maintained across all the training, validation, and test subsets. This balancing strategy was implemented to preserve the statistical representativeness of the overall dataset and to reduce the risk of sampling bias [46], where certain attack types might otherwise be over- or under-represented in specific subsets. Maintaining this distribution helped to ensure that the model was exposed to a similar variety of attack patterns in each phase of learning and evaluation, ultimately supporting more robust and generalizable results. Nonetheless, one important limitation of the UNSW-NB15 dataset is the inherent class imbalance. Several attack categories, such as Worms and Backdoor, are significantly under-represented compared to dominant classes like Generic or Exploits. This imbalance can skew both model training and post hoc explainability analysis, resulting in less reliable interpretations for minority attack types, which are often of high forensic relevance. Although this study focused on evaluating explainability techniques under standard dataset conditions, future work will incorporate class-rebalancing strategies to mitigate this issue.