# Explainable AI Assisted IoMT Security in Future 6G Networks
## 4 Materials and Methods
SMOTE generates new minority instances using nearest neighbors, preserving key majority-class information without duplication. This approach generates synthetic instances by interpolating between a given minority class instance, \(x_{i}\), and one of its \(k\) nearest neighbors, \(x_{nm}\). The new synthetic instance \(\mathrm{x_{new}}\) is computed as follows:  
\[x_{new}=x_{i}+\lambda.\left(x_{nm}-x_{i}\right) \tag{1}\]  
In Equation (1), \(\lambda\) is a randomly selected value from a uniform distribution in the range [0, 1]. This technique ensures that the synthetic data points are systematically positioned along the line segment connecting \(x_{i}\) and \(x_{nm}\), effectively enhancing the diversity of the minority class without simply duplicating the existing data. The dataset was pre-processed for binary classification (attack vs. normal) and split into 80-20 ratio for training and testing purposes. Various machine learning models, including Logistic Regression [31], Random Forest [32], KNN [33], and a CNN [34], were evaluated to classify the network traffic. These models were selected for their distinct strengths: Logistic Regression for its simplicity and interpretability, Random Forest for its robustness to overfitting and ability to handle complex interactions, KNN for its effectiveness in non-linear data classification, and the CNN for its ability to automatically learn hierarchical features from raw data. Each model was chosen to provide a balanced comparison of performance. To ensure model interpretability, XAI techniques were used to interpret the model's decisions and to identify key factors that are influencing model predictions. These techniques are essential for building trust and accountability in cybersecurity applications. Specifically, SHAP quantifies the contribution of each feature to the model's prediction, assigning specific values to each feature [17]. The value for feature \(i\) in prediction \(x\) is computed using the following formula:  
\[\varnothing_{i}(x)=\sum_{S\subseteq\{1,2,...,p\}\setminus\{i\}}\frac{|S|!(p-|S| -1)!}{p!}[f(S\cup\{i\})-f(S)] \tag{2}\]  
In Equation (2), \(\varnothing_{i}(x)\) denotes the SHAP value for feature \(i\) at instance \(x\), \(S\) is the subset of the features excluding \(i\), \(|S|\) denotes the number of features in the subset \(S\), \(|S|! (p-|S|-1)!\) is the number of ways to select subset \(S\), \(p\) represents the total number of features, and \(f\) is the model's prediction function. This method provides a comprehensive explanation of how each feature affects the model's decision. The other XAI method, LIME, approximates the model's prediction function \(f\) locally around an instance \(x\) by minimizing a loss function [18]. This method enables the interpretation of complex models in the vicinity of a specific instance. The optimization problem is expressed as follows:  
\[\hat{g}=argmin_{S}\ L(f,g,\ \pi_{x})+\Omega(g) \tag{3}\]  
In Equation (3), \(\hat{g}\) denotes the interpretable model, \(\pi_{x}\) represents the proximity measure around \(x\), L is denoted as a loss function, and \(\Omega(\mathrm{g})\) is a penalty term ensuring the complexity of \(\mathrm{g}\). Also, the DiCE method generates multiple counterfactuals, or alternative explanations, for a model's prediction, helping us to understand what changes could lead to a different outcome [19]. This process aids in uncovering the sensitivity of the model's predictions to variations in the feature values. The objective of optimization for DiCE is to identify counterfactuals that are close to the original input, providing insights into the sensitivity of the model's decisions.