## 4 Results
### SHAP and LIME for Explainability and Interpretability  
To better understand the internal decision-making process of the models, SHAP (SHapley Additive exPlanations) values were used to quantify the contribution of each input feature to the final prediction. Figure 7 presents a comparative summary of the mean SHAP values for the top features identified by XGBoost and TabNet. This visualization allows for a direct comparison of how each model prioritizes specific variables when classifying instances. Notably, while both models highlight features related to traffic state and packet flow, the magnitude and ranking of importance vary, reflecting differences in how each architecture captures and leverages patterns in the data. Figure 5: Confusion matrix of XGBoost. Figure 6: Confusion matrix of TabNet. The comparative SHAP summary reveals several insights into how XGBoost and TabNet differ in their interpretation of feature relevance. The most striking observation is the disproportionately high SHAP value assigned to the sttl feature by XGBoost, suggesting that this model relies heavily on the TTL (time-to-live) field as a discriminative indicator. In contrast, TabNet distributes importance more evenly across multiple features, with ct_state_ttl emerging as the top contributor--an indicator that it leverages aggregated connection-state and TTL behavior, rather than relying on a single raw feature. Another interesting divergence is the role of dbytes and sbytes (destination and source byte counts), which are more influential in XGBoost, possibly due to its tree-based structure's ability to capture value thresholds. Meanwhile, TabNet attributes more weight to features like ct_src_dport_1 tm and spkts, which reflect connection-level patterns over time, aligning with its sequential attention-based mechanism. These differences suggest that XGBoost tends to exploit sharply defined thresholds in a few dominant features, leading to more concentrated feature reliance. In contrast, TabNet demonstrates a more distributed pattern of interpretability, possibly enhancing its robustness to minor input variations. Overall, the comparative SHAP analysis not only highlights key predictive features across both models, but also provides a window into their architectural biases--XGBoost's tendency for feature dominance versus TabNet's distributed feature sensitivity. In addition to the global interpretability analysis, local explanations were generated for specific prediction instances using both LIME and KernelSHAP. The objective was to compare the classifications assigned by each model on a given instance and to identify the most influential features that contributed to the decision. This approach allowed for an in-depth examination of how each explainer attributes importance to individual input variables, highlighting potential divergences in their interpretative focus and reinforcing the need for multi-perspective explainability in model evaluation. To complement the global interpretability assessment, local explanations were generated using LIME for three randomly selected instances from the test set. Figure 8 presents the individual feature contributions to the model's predictions for samples 133,349, 18,339, and 45,127. This visual comparison reveals consistent patterns in the most influential features, while also highlighting slight variations across instances. Such insights are crucial for validating the reliability and consistency of the model's decision-making process. Figure 7: Comparative SHAP summary: XGBoost vs. Tabnet. The LIME-based explanations for instances 133,349, 18,339, and 45,127 reveal both consistencies and variations in the feature contributions to the model's predictions. In all three cases, the features smean and ct_srv_dst consistently emerge as the most influential, positively reinforcing the classification output. This suggests that the model relies heavily on traffic-level summary statistics and service-destination patterns to distinguish between normal and attack instances.