## 5 Application of Reinforcement XAI Model
### Feature Importance by Value Ranges  
These values alone might give information about the importance of a feature in comparison with the rest. However, with the exception of the nominal one-hot-encoded features, the \"high\" or \"low\" levels of numerical features might prove less intuitive. In  
Figure 4: Feature importance interpretation with SHAP values for top 10 relevant features per each class.  
the context of an IDS, an expert would require greater precision to be able to make use of this explanation. The following Algorithm 2 computes the mean SHAP value for a feature divided by ranges, which can impact a specific range of values for a numerical feature has on a classification. This method uses the previous iterations over 5000 random samples to divide each feature's possible values on the desired number of intervals, computing the average SHAP value of all samples whose feature value lies inside said intervals.  
```
1:\(f\leftarrow\) Characteristic to be evaluated
2:\(c\leftarrow\) Class to be evaluated
3:\(SHAP\_values\leftarrow\) SHAP values resulting from the samples used
4:\(n_{i}\leftarrow\) Number of intervals into which to divide \(f\) values based on the training dataset
5:\(i_{p}\leftarrow\) An \(n_{i}\)-length array with the values of \(f\) after processing (MinMax) corresponding to the limits of the intervals
6:\(i_{o}\leftarrow\) Array of \(n_{i}\) length with original \(f\) values corresponding to the limits of the intervals
7:\(f\_values\leftarrow\) Values of \(f\) in samples used for calculating SHAP values, i.e., after processing
8:\(Empty\leftarrow\) Empty Array
9:\(x\_ticks\leftarrow\) Empty Array
10:for\(i\) in \((n_{i}-1)\)do
11: A mask is created according to \(i_{p}[i]\leq f\_values<i_{p}[i+1]\). If it's the last iteration, the upper limit is included
12: Add to \(x\_ticks\) the evaluated interval with the original values in String format: \"\(\geq i_{o}[i]\&<i_{o}[i+1]\)\". If it's the last iteration, the upper limit is included
13: The mask is applied to the \(SHAP\_values\) of class \(c\), obtaining the SHAP values of all the characteristics of the samples that comply with the mask. The values corresponding to the Objective Feature \(f\).
14: The average of the values obtained is calculated and added to the array _res_
15:endfor
16:return\(res,x\_ticks\)
```  
**Algorithm 2** Obtaining mean SHAP values based on ranges of a feature for a class  
After applying this methodology to the numerical values used in the explanation for the Analysis class with four intervals per feature, Figure 5 illustrates the effectiveness of this algorithm when applied to the feature Ct, srv, dst.  
This feature quantifies the number of connections sharing the same service and destination address within the last 100 recorded connections.  
Figure 5: Feature relevance by ranges as shown by its average SHAP value for the “Analysis” class.  
Ranges whose mean SHAP value is positive can be observed, showing relevance for a positive model classification. Over 15 close-by connections with one identical address for the service and destination might be indicative of an Analysis attack. This information might prove useful for the construction of specific controls and security measures disallowing connections when the proper flags are raised. A list showing the specific values of relevance for the top features as shown in Figure 3 is included in Table 4. This shows the values our trained model inferred as indicators of an attack of this class.  
It is necessary to mention that the accuracy in numerical values is subject to the number of intervals used and, in addition, not in all cases the values for the nominal characteristics are as easily discernible as in this example. Finally, a global explanation of the model is shown in Figure 6, corresponding to the impact of characteristics across all classes, where the dominance of nominal characteristics is appreciable.