## 4 Experimental Result
On the other hand, the input features were standardized, incorporating the StandardScaler technique, and no missing or null values were discovered in the data set, which ensures a clean data set, providing less information loss with a balanced feature set for learning. Additionally, a categorical cross-entropy was incorporated as a loss function, which is suitable for multi-class categorization, promoting accurate probability estimation among all output categories. In addition, the dropout layers were employed in the framework,  
Figure 6: SHAP value representation of significant features on the projected output for each class ranked by decreasing significance. as it mitigates overfitting and contributes to the generalization capability of the proposed architecture. These parameters cooperated all together to achieve low loss values and efficient classification performance. Moreover, the proposed framework achieved a precision of 0.886, a recall of 0.678, and an F1-Score of 0.698. During the testing phase, the model achieved consistent behavior with a precision of 0.8908, a recall of 0.684, and an F1-score of 0.705. The comparatively high precision indicates that, when the experimented structure detects an instance as intrusion, it is likely to be correct, minimizing the false positives. The average recall value indicates that the framework might miss some incidents of false negatives despite being cautious in identifying malicious behavior. On the other hand, the value of the F1-score indicates the balance between precision and recall, and it demonstrates a consistent generalization ability across observed and unseen components. The limitation of our model is the low output value, which indicates that this framework still needs fine-tuning, a parameter reset, and other appropriate techniques' incorporation to enhance the output parameter values. However, the strength of the proposed model lies in discovering the most significant features while breaching the network. In the future, we can reduce the dimensionality of the data set, focusing only on the significant features that we enlisted by deploying the SHAP framework. Thus, we may obtain better output values than the current ones. In Figure 6, a summary of the feature importance visualizations that were derived from the SHAP framework is shown. SHAP estimates the average influence of every feature on the overall dimension of the output of the model across all classes. On the \(x\)-axis, the mean \"SHAP value\" is demonstrated, which displays the average quantity of the contribution of a feature to the evaluation of the model. In our experiment, the features' contribution is shown as a positive influence on the overall framework. This metric shows the overall effect of each feature on the projected accuracy of the model, providing a global measure of feature relevance. On the other hand, the \(y\)-axis enlists  
Figure 7: Experimental findings of FedXAIIDS. (**a**) Accuracy graph for participants of FedXAIIDS of both training and testing sessions. (**b**) Loss graph for participants of FedXAIIDS of both training and testing sessions. the characteristics of the data in a decreasing sequence, meaning a start from the most influenced class to the least influenced class. The classes are Class 0--DDoS, Class 1--DoS, Class 2--Mirai, Class 3--Benign, Class 4--Other, and Class 5--Recon. In the figure, the classes are represented by the following colors: DDoS--red, DoS--blue, Mirai--purple, Benign--magenta, Other--olive green, and Recon-dark teal. The width of each color represents the impact of that particular feature on each class. From Figure 6, we can observe that the 10 most significant features of CICIoT2023 are feature 28--UDP, 31--ICMP, 42--Magnitude, 27--TCP, 8--fin_flag_number, 3--Protocol type, 10--rst_flag_number, 15--ack_count, 17--fin_count, and 11--psh_flag_number. Furthermore, feature 28 has the most influence on identifying the attack classes on the CICIoT2023 data set.