## 6 Conclusions  
This study has demonstrated the critical role of Explainable Artificial Intelligence (XAI) techniques, specifically SHAP and LIME, in enhancing the forensic reliability of machine learning models used in intrusion detection systems (IDSs). By applying these techniques to both a tree-based model (XGBoost) and a deep learning architecture (TabNet), we have provided a comprehensive evaluation of their interpretability, consistency, and forensic applicability using the UNSW-NB15 dataset. From a forensic perspective, SHAP emerges as a robust tool for ensuring the legal defensibility of AI-generated evidence. Its adherence to game-theoretic properties, completeness, local accuracy, and consistency enables transparent and auditable attributions that align with the evidentiary standards required in judicial contexts. In contrast, LIME offers rapid and localized explanations, making it a valuable asset during incident response and real-time forensic triage. The comparative results highlight that while SHAP provides more coherent global explanations, particularly when used with structured models like XGBoost, LIME complements this by offering granular and interpretable insights at the instance level, which are especially useful in the validation of individual alerts. The joint application of both methods is therefore recommended in forensic workflows, allowing analysts to benefit from both macro-level understanding and micro-level justification of model decisions. Furthermore, the integration of fidelity, stability, and similarity metrics provides a quantitative framework for assessing explanation robustness an essential requirement for their acceptance as digital evidence. By incorporating these metrics, forensic practitioners can better assess the reliability of XAI outputs in support of investigative hypotheses. In addition to post hoc methods, the use of intrinsically interpretable models like TabNet allowed for a direct comparison between native attention masks and the attribution rankings derived from SHAP and LIME. This complementary analysis revealed that TabNet's internal attention mechanisms partially aligned with external explainers in highlighting critical features such as tcprtt, dbytes, andbytes, validating the consistency of interpretability sources across architectures. The findings also underscore that explanation quality can degrade when applied to models with suboptimal learning behavior. As such, we deliberately included low-performing classifiers to evaluate the resilience of interpretability tools in realistic forensic conditions, where imperfect models are often encountered. This aspect reinforces the importance of measuring explanation stability even under uncertainty. In summary, this research supports the adoption of SHAP and LIME as complementary explainability tools in forensic cybersecurity. Their inclusion in the digital forensic process not only improves transparency and expert confidence, but also promotes compliance with emerging regulatory frameworks for trustworthy AI. Future work should focus on integrating these XAI techniques into forensic platforms, developing visualization dashboards for legal stakeholders, and formalizing forensic-readiness evaluation criteria for explainable models. Looking forward, future research should prioritize the development of hybrid explainability frameworks that integrate both global and local interpretability capabilities, incorporate native model explainability such as attention mechanisms, and leverage forensic-readyvisualization platforms that facilitate legal admissibility and enhance analyst usability in high-stakes environments. Conceptualization, P.H. ; methodology, P.H. ; formal analysis, P.H. and S.B. ; investigation, P.H. and S.B. ; data curation, P.H. ; writing--original draft preparation, P.H., S.B., and H.A.-C.; writing--review and editing, P.H., S.B., and H.A.-C.; visualization, P.H. and S.B. ; supervision, P.H., S.B., and H.A.-C.; project administration, P.H.