# Explainable AI Assisted IoMT Security in Future 6G Networks
## 5 Experiments and Results
### Implementation of Explainable AI Techniques: SHAP, LIME, and DiCE
#### 5.4.2 SHAP  
Local Behavior Analysis  
The SHAP global summary plot shows overall feature importance but doesn't explain individual predictions. This highlights the need for local interpretability which is provided by the SHAP force plot. This plot visually provides instance-specific insights, enhancing  
Figure 8: SHAP force plot. Figure 7: Feature importance plot for Random Forest. interpretability and trust in AI-driven security and healthcare applications. The plot employs the following:  
* Red indicates positive contributions (pushing prediction higher), increasing the likelihood of the predicted class. * Blue represents negative contributions (pulling prediction lower), usually decreasing the likelihood of the predicted class, favoring the opposite prediction. * The width of each bar reflects the magnitude of the feature's influence, with wider bars indicating a stronger effect. * It starts with the base value (average model output) and accumulates feature contributions to display the final prediction at the end. 1. SHAP Force Plot for Test Sample Record 1--'Normal' Traffic Prediction  
Figure 9 shows the SHAP force plot for sample record 1, highlighting how individual features influenced the model's prediction. The actual target is labeled as \"Normal\", meaning that in the dataset, this instance is truly a non-attack instance. The model's prediction output (f(x) = 1.00) suggests that the model classified this instance as not an attack. Table 3 lists the key features from the SHAP force plot that contribute to the \"Normal\" traffic prediction. It includes feature descriptions, their roles in the model's decisions, and how specific values support the classification as non-attack traffic. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Features** & **Full Form** & **Interpretation** & \begin{tabular}{c} **Reason for ‘Normal’** \\ **Prediction** \\ \end{tabular} \\ \hline \multirow{4}{*}{**scptimines\_**} & & \begin{tabular}{c} It indicates high idle \\ time where resources \\ are not being \\ excessively consumed \\ by malicious processes \\ or attack-related \\ activities. \\ \end{tabular} & \begin{tabular}{c} Positive contribution \\ reflects standard user \\ activity, without being \\ overloaded by the malicious \\ or abnormal processes. \\ \end{tabular} \\ \hline \multirow{4}{*}{**scptimines\_**} & \begin{tabular}{c} CPU \\ Time \\ in User \\ Mode \\ \end{tabular} & \begin{tabular}{c} Suggests that the \\ system’s CPU is being \\ used by typical \\ user-level applications \\ or processes. \\ \end{tabular} & \begin{tabular}{c} Positive contribution \\ reflects standard user \\ activity, without being \\ overloaded by the malicious \\ or abnormal processes. \\ \end{tabular} \\ \hline \multirow{4}{*}{**stats\_soft\_**} & \begin{tabular}{c} CPU \\ Software \\ Interrupts \\ Count \\ \end{tabular} & \
\begin{tabular}{c} In a normal scenario, \\ software interrupts are \\ expected to be at a \\ \end{tabular} &
\begin{tabular}{c} Positive contribution \\ indicates that the system is \\ processing normal, \\ expected software \\ interrupts without any \\ significant anomaly or \\ malicious activity. \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 3: SHAP force plot for normal traffic classification. Figure 9: SHAP force plot for record sample 1 from test dataset (local explanation)—predicting Class 0—”Normal” traffic.