## 6 Conclusions and Future Lines
\begin{table}
\begin{tabular}{l l l l l l l l l l l} \hline \hline
**Work** & **Algorithm** & **Classification** & **Dataset** & **Real Time** & **XAI** & **Accuracy** & **Precision** & **Recall** & **FRP** & **F1** \\ \hline This research & Random Forest & Binary & UNSW-NB15 & YES & YES & 98.9\% & 98.9\% & 99.0\% & 2.21\% & 98.9\% \\ This research & Random Forest & Multiclass & UNSW-NB15 & YES & YES & 96.7\% & 96.1\% & 94.7\% & 5.2\% & 95.4\% \\
[24] & Forest & Multiclass & UNSW-NB15 & NO & YES & 91\% & - & - & - & - \\
[25] & Random Forest & Multiclass & UNSW-NB15 & NO & YES & 83.12\% & - & - & 3.7\% & - \\
[26] & Random Forest & Multiclass & UNSW-NB15 & NO & YES & 77.16\% & - & - & 22\% & - \\
[27] & Random Forest & Binary & UNSW-NB15 & NO & YES & - & 99\% & 99\% & 0 & - \\
[12] & SVM & Binary & NSL-KDD & NO & NO & 99.92\% & - & 99.93\% & 0.14\% & - \\
[14] & ELM & Binary & NSL-KDD & NO & NO & 99.5\% & 98.6\% & 98.6\% & - & - \\
[14] & SVM & Binary & (1/2) & NO & NO & 98.4\% & 98.9\% & 98.7\% & - & - \\  & & NSL-KDD & NO & NO & 99.3\% & 98.6\% & 98.6\% & - & - \\
[16] & LSTM & Multiclass & KDD & YES & NO & 83.57 & 96.45\% & 72.62\% & 3.57\% & 82.95\% \\ Decision Tree & Multiclass & RLD09 & YES & NO & 99\% & - & 99\% & - & - \\
[18] & Decision Tree & Binary & UNSW-NB15 & NO & NO & 90.85\% & 80.33\% & 98.38\% & - & - \\
[19] & Neural Network & Multiclass & NSL-KDD & NO & YES & 80.6\% & 83\% & 83\% & 80.3\% & \(-\)79.7\% \\
[21] & MLP & Binary & KDD & NO & YES & 82\% & 96.4\% & 71\% & - & 82\% \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Final comparison with Related Works. components without losing the final operation of the system in a software-spaced design to be deployed in a real system [7]. For this reason, there are several points that could be improved or extended in each block to provide more complete functionality to the user. The trace monitoring block is the component that can be updated and improved the most using real tools such as Zeek or Bro-IDS, as explained throughout the research, to obtain real information from a network point, classifying the different characteristics necessary for the operation of the system. If we continue with the next big component of the research, the data processing block, it is the main container of the Spark executor script, with different points that can be improved or extended to provide greater functionality. As a first phase, increase the number of models available, including others as SVM (support vector machines) or combinations of algorithms for Stacking model assembly types, which were not carried out due to the computational capacity and simplicity of the research. Another feature to be studied in a possible continuation is increasing user customization of the pre-processing performed on the dataset with different normalizations or encodings. Finally, an important functionality to add would be to connect the explanatory module hosted in the results visualization block to calculate the SHAP values directly in the Spark script, thus improving the performance of the system. In the last module of the research, the results representation block, there are three functionalities that could be updated or added: Firstly, an improvement in the presentation of results in a more detailed way, if necessary. Secondly, a functionality to allow adding a static option to choose local records stored in the MongoDB database and displaying them in the same way as the real-time traces. Lastly, an improvement of the representation of the results of the explanation of each trace, a more textual way of explaining why each prediction has been made without the user needing to understand the graphs, together with the aggregation of different visualizations that the SHAP library allows, with even more complex and exact explanations available for the models.