## 1 Introduction  
The objective of creating robust Intrusion Detection Systems (IDSs) has led these types of applications to adopt technologies such as Machine Learning (ML), often exploring the use of unconventional models for traffic classification tasks [1]. Those models, based on Deep Neural Networks (DNNs) [2], have become a popular and general solution due to their generally high performance and the possibilities for customization. However, these advantages make a model fairly complex, which has led to these models and their derivatives being categorized as \"black boxes\", since determining the relationship or logic between input data and results is not possible without further development [3].  
There is currently a great interest in making these types of models more interpretable, by implementing techniques of what is called eXplanatory Artificial Intelligence (XAI) [4]. In the context of an IDS, the application of these types of techniques can be useful for a fast, effective and targeted response, as well as for the purposes of model tuning and correction.  
Taking this into account, the problem that first arises in this research work is to explore how an unconventional model would be integrated as an Anomaly Intrusion Detection System (aIDS), based on attack categorization. A possible model is one based on Reinforcement Learning (RL) that, unlike a traditional supervised one, is based on modeling the environment with which an agent (the algorithm) interacts and learns, and applies changes following a reward system. Second, what XAI techniques can be applied in order to carry out a subsequent analysis of its operation, taking into account that this family of algorithms falls within the so-called \"black box\" category.  
This research addresses the limitations posed by SHapley Additive eXPlanations (SHAP) in Intrusion Detection Systems (IDSs) based on anomaly detection, specifically overcoming the restrictions that SHAP imposes on deterministic models, as detailed in Section 2. Rather than providing a full framework implementation at this stage, this work sets potential research objectives, encouraging further exploration and development of the proposed IDS framework's individual components. The study focuses on IDSs driven by network traffic analysis, aiming to enhance anomaly detection in cybersecurity environments.  
Furthermore, this research proposes using the benchmark dataset UNSW-NB15 [5] to test an algorithm capable of identifying different types of malicious traffic. The specific algorithm is a R.  
Reinforcement Learning (RL) model utilizing Proximal Policy Optimization (PPO). The goal is to understand how the algorithm makes its decisions through the application of SHapley Additive exPlanations (SHAP) using a Python library of the same name. Section 4 further outlines the problem statement and proposed methodology, defining the ML algorithm and presenting the model evaluations to achieve a multiclass classification with SHAP explanations as the primary objective.  
Additionally, this research emphasizes feature-level explanations, enabling IT administrators to identify relevant features within potential threats and gain clearer insights into the attacker's path. By interpreting which ranges of feature values might influence classifications, system administrators are better prepared to create specific filters or rules for advanced security tools, such as Extended Detection and Response (XDR) or Security Information and Event Management (SIEM) systems, facilitating a rapid, attribute-focused response to incidents.  
This article introduces the background and related work to this research work in Sections 2 and 3. Section 4 explains the problem statement and the proposed methodology, defining the methodology ML algorithm presented in this paper. These sections also include the evaluation of the different models acquiring a multiclass classification with the main objective on SHAP explanations. Finally, Section 5 includes the discussion of the main conclusions and future lines for this research work.