## 4 Results
### Baseline Systems  
We compare our feature extraction approach with two baseline systems [35,36]. In [36], the authors proposed a feature importance method that is based on the information gain of each feature based on entropy. On the other hand, the authors of [35] selected the feature importance by applying the K-best method [69]. Table 16 shows the summary of the top features extracted by these baselines. ### Baseline Systems  
We compare our feature extraction approach with two baseline systems [35,36]. In [36], the authors proposed a feature importance method that is based on the information gain of each feature based on entropy. On the other hand, the authors of [35] selected the feature importance by applying the K-best method [69]. Table 16 shows the summary of the top features extracted by these baselines. Top Features' Extraction:To understand the difference, we first compare our resulting features (Table 4) with the baseline features (Table 16). We observe that the order of feature importance determined by our method does not match those obtained by the baselines for both datasets. However, there are common features among both feature extraction methods. For example, TCP_WIN_MAX_IN, TCP_WIN_MIN_IN, TCP_WIN_MIN_OUT, and FLOW_DURATION_MILLISECONDS are common top features for the RoEduNet-SIMARGL2021 dataset. For NSL-KDD, the overlapping top features between our method and the baselines are dst_host_srv_count, dst_host_same_src_port_rate, and count. We accentuate that none \begin{table}
\begin{tabular}{c c c} \hline \hline
**Feature Importance** & **CICIDS-2017** & **RoEduNet-SIMARGL2021** & **NSL-KDD** \\ \hline
1 & Packet Length Std & FLOW_DURATION\_MILLISECONDS & same\_srv\_rate \\
2 & Total length of Bwd Packets & FIRST\_SWITCHED & flag\_SF \\
3 & Stuflow Backward Bytes & TOTAL FLOWS EXP & flag\_S0 \\
4 & Destination Port & TCP\_WIN\_MS\_IN & dst\_host\_srv\_error\_rate \\
5 & Packet Length Variance & LAST\_SWITCHED & dst\_host\_server\_rate \\
6 & Bwd Packet Length Mean & TCP\_WIN\_MAX\_IN & error\_rate \\
7 & Avg Bwd Segment Size & TCP\_WIN\_MIN\_IN & src\_server\_rate \\
8 & Init\_Win\_Bytes\_Backward & TCP\_WIN\_MIN\_OUT & dst\_host\_same\_srv\_rate \\ \hline \hline \end{tabular}
\end{table} 
Table 16: The list of top significant features according to baselines. References [35,36] were used for RoEduNet-SIMARGL2021 and CICIDS-2017, respectively. Ref. [34] was also used for the NSL-KDD dataset. \begin{table}
\begin{tabular}{l c c c c c c c} \hline \hline
**SHAP Efficiency (Samples \(\times\) Hours)** & **RF** & **DNN** & **LGBM** & **MLP** & **ADA** & **SVM** & **KNN** \\ \hline
100 & 0.001 & 0.001 & 0.001 & 0.014 & 0.129 & 0.041 & 1.104 \\
500 & 0.002 & 0.004 & 0.001 & 0.925 & 3.557 & 0.841 & 28.33 \\
2500 & 0.011 & 0.029 & 0.002 & 21.18 & 99.00 & 20.87 & 706.0 \\
10,000 & 0.046 & 0.306 & 0.006 & 385.0 & 1512 & 343.0 & 1654 \\ \hline
**LIME Efficiency (Samples \(\times\) Hours)** & **RF** & **DNN** & **LGBM** & **MLP** & **ADA** & **SVM** & **KNN** \\ \hline
1000 (RoEduNet-SIMARGL2021 ) & 1.401 & 1.452 & 1.423 & 1.466 & 1.416 & 1.483 & 6.666 \\
1000 (CICIDS-2017 ) & 3.812 & 3.766 & 3.750 & 3.855 & 3.956 & 3.816 & 15.816 \\
1000 (NSL-KDD) & 2.287 & 2.110 & 2.337 & 2.389 & 2.478 & 3.112 & 12.878 \\ \hline
**SHAP Local Efficiency (Minutes)** & 0.001 & 0.001 & 0.001 & 0.001 & 0.001 & 0.001 & 0.001 \\ \hline
**LIME Local Efficiency (Minutes)** & 0.351 & 0.311 & 0.294 & 0.284 & 0.294 & 0.306 & 0.357 \\ \hline \hline \end{tabular}
\end{table} 
Table 15: The efficiency, measured in hours, in generating SHAP and LIME explanations across various AI models and differing sample sizes. of these baselines explain their feature selection using SHAP and that both of them used a lower number of AI models. **Effect of Different Top Features:** We next compare the performance of AI models under the top five significant features selected by XAI-IDS versus those selected by information gain [36] and K-best [35].