## 5 Discussion
### Consolidated Comparative Analysis and Strategic Recommendations for Forensic XAI in IDS  
This study reinforces that SHAP and LIME should be considered complementary, rather than exclusive, approaches when configuring explainable and forensic-ready IDSs. SHAP should be prioritized in validation processes, forensic reporting, auditing, and pericial documentation, aligning with the principles of transparency, accountability, and explainability outlined by regulatory frameworks such as GDPR, the EU AI Act, and international standards such as ISO/IEC 23894:2023 [47]. Simultaneously, LIME finds its role in immediate-operational-response and exploratory-analysis phases, where interpretive agility is a key factor, albeit with evident limitations for use in technical or legal defense processes. From a forensic-auditing perspective, it is also essential to consider the interaction between intrinsic and post hoc explanation mechanisms. While intrinsic models (e.g., TabNet) provide built-in transparency through attention-based or feature-selection processes, these explanations may lack consistency or completeness under certain conditions. Post hoc methods like SHAP and LIME can complement these limitations by offering more stable and auditable outputs. However, divergence between intrinsic and post hoc interpretations can also introduce confusion or reduce interpretative trust. Thus, combining both approaches in a hybrid framework strengthens interpretability, legal defensibility, and alignment with regulatory standards.  
Beyond the choice of explainability method, forensic reliability also depends critically on the generalization capacity of the underlying model. Overfitted models, even when paired with advanced explanation tools, may generate outputs that appear interpretable, but fail to reflect consistent or legally defensible reasoning under real-world conditions. This risk is particularly concerning in forensic auditing, where explanations must withstand scrutiny, replication, and cross-examination. Therefore, explanation metrics such as fidelity and stability should be interpreted not only as technical indicators, but as safeguards against misleading conclusions in high-stakes environments.  
Moreover, it is recommended to advance towards the integration of hybrid architectures that combine SHAP's global explanatory power with LIME's local agility, complemented by robust explanatory validation metrics (fidelity, stability, Jaccard similarity), as proposed in this study [33, 38]. Future research should focus on exploring emerging XAI techniques such as graph-based explainability, causal reasoning, and counterfactual methods, thus strengthening the ability to generate contextualized and defensible explanations in complex and high-criticality forensic scenarios [49].  
This study confirms that XAI methods, particularly SHAP and LIME, significantly enhance the interpretability, transparency, and forensic reliability of AI-driven intrusion detection systems. The choice between the individual use of these techniques or their combined deployment should be context-dependent: SHAP is well suited for scenarios requiring compliance, accountability, and traceability, whereas LIME excels in agile, instance-level diagnostics and operational decision-making. Altogether, this approach reinforces the trustworthiness of explainable IDSs and promotes their adoption within legal and regulatory frameworks.