## 3 Materials and Methods
### Model Training and Explainability Setup  
Following preprocessing and feature selection, two machine learning models were trained to support a comparative analysis of explainable artificial intelligence (XAI). The first model employed XGBoost, a tree-based ensemble method known for its efficiency and effectiveness in anomaly detection tasks within cybersecurity. The second model utilized TabNet, a deep learning architecture designed for tabular data that combines embedded feature selection with native interpretability. Both models were trained using the processed dataset and were optimized using early stopping based on validation loss to mitigate overfitting. This training strategy ensured efficient learning convergence while preserving model-generalization capacity. The classifiers were further evaluated through SHAP and LIME to explore their respective explainability characteristics and to assess how model transparency varied across inherently interpretable and black-box-like algorithms. \begin{table}
\begin{tabular}{p{85.4 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Stage** & **Technique** & **Description** \\ \hline Encoding and Transformation & Categorical Encoding & Conversion of categorical variables (e.g., protocol, state) to numerical format. XGBoost uses ordinal encoding; TabNet manages embeddings internally. \\ \hline Normalization and Scaling & Min–Max Scaling & Continuous features were normalized to the [0, 1] range to ensure proportional influence across inputs. \\ \hline Training Optimization & Early Stopping & Training was stopped based on validation loss to avoid overfitting, using a predefined patience value. \\ \hline Feature Selection and Filtering & Feature Exclusion & High-cardinality and non-informative features (e.g., IP addresses, port numbers) were excluded to reduce noise and enhance interpretability. \\ \hline \hline \end{tabular}
\end{table} 
Table 10: Preprocessing techniques applied to input features, grouped by stage. XGBoost was initialized with 100 boosting rounds (n_estimators = 100) and a moderate learning rate of 0.1, which balanced convergence speed with model stability. Early stopping was applied with a patience of 10 rounds to prevent overfitting, based on validation loss (early_stopping_rounds = 10). Tree complexity was controlled using a maximum tree depth of 6 (max_depth = 6) and a minimum child weight of 1 (min_child_weight = 1), allowing the model to learn detailed patterns without excessive granularity. To promote generalization, both row (subsample = 0.8) and column (colsample_bytree = 0.8) subsampling were used during training. The classifier was optimized for binary classification using a logistic objective (objective = 'binary:logistic'), and the evaluation metric selected was log loss (eval_metric = 'logloss'), which provides a probabilistic performance measure that is suitable for imbalanced datasets. A fixed seed (random_state = 42) ensured reproducibility, and the native label encoder was disabled (use_label_encoder = False) to allow for custom preprocessing and compatibility with external label formats. TabNet was initialized with 8 decision steps (n_d = 8) and 8 attentive transformation dimensions (n_a = 8), forming the core of its feature representation and attention-based decision process. The number of sequential decision steps was set to 3 (n_steps = 3), and a sparsity regularization coefficient of \(1\times 10^{-4}\) (lambda_sparse) was used to enforce selective attention on the most informative features. The relaxation parameter \(\gamma=1.3\) controlled the decision-step behavior, enhancing feature reuse. No categorical embeddings were explicitly defined in cat_emb_dim or cat_idxs, given the preprocessed input format. Optimization was performed using the Adam optimizer (optimizer_fn = torch.optim.Adam) with a learning rate of \(2\times 10^{-2}\), and learning rate decay was managed through a step scheduler that reduced the learning rate every 10 epochs by a factor of 0.1.