## 2 Related Work
Once the results from the fitted one-vs-all classifiers are obtained, the proposed framework generates both local and global explanations for the detection of specific attack classes. Lastly, a target-vs-normal classifier is developed to classify between a targeted attack class and normal traffic. The research work published in this article confirms a strong correlation between input features and attack classes, demonstrating the validity of classifier predictions. [PERSON] et al. [14] proposes a framework comprised of a two-stage pipeline for network intrusion detection. In the first stage, data for the NSL-KDD dataset are collected and processed into a feature vector. Next, an XGBoost model is trained for binary classification, distinguishing between normal and malicious traffic. This stage serves as the basis for preliminary intrusion detection. Next, the SHAP framework is employed to provide explanations for the model's decisions, focusing on the contribution of each feature to the classification outcome. In the second stage of the pipeline, the explanations generated in the previous stage are utilized to train an auto-encoder, forming the basis of an anomaly-based Network Intrusion Detection System (NIDS). This auto-encoder consists of two key components: a DNN encoder and a DNN decoder. The encoder compresses the previously generated explanations into a lower-dimensional representation, while the decoder reconstructs the original input from this compressed representation. By analyzing the reconstruction error of the auto-encoder, changes in behavior patterns can be identified, which are indicative of anomalous behavior. The experiments conducted on the NSL-KDD dataset demonstrate the framework's capability to detect new attacks. Moreover, the framework's overall performance is found to be comparable to numerous state-of-the-art research works in cybersecurity. [PERSON] et al. [15] focus on developing a classifier for network intrusion that combines high prediction with an explainer to interpret the classifier's predictions. They evaluate global XAI methods such as Permutation Importance (PI) and SHAP, along with local XAI methods like SHAP, LIME (Local Interpretable Model-agnostic Explanations), and CIU (Contextual Importance Utility), to interpret predictions made by Random Forest (RF), XGBoost, and LightGBM (LGBoost) models on both the Kaggle IDS and NSL-KDD datasets. The research mentioned above evaluates the robustness of explanation methods in terms of accuracy, recall, and precision, particularly focusing on the top 15 featuresidentified by PI and SHAP on the NSL-KDD dataset. The obtained results achieve values of accuracy up to 70% to 75% in model predictions based on these features. Local explanation methods were also examined for their consistency and stability. The proposal in [16] aims to increase the explainability of decisions made by DL Intrusion Detection Systems for IoT networks. The framework consists of three main components: a DNN-based IDS specifically designed for IoT networks, built using deep neural networks (DNNs); and three XAI techniques: RuleFit, LIME, and SHAP, generating local, global, and feature importance-based explanations, respectively. In this work, two public network security datasets are considered: NSL-KDD and UNSW-NB15. The results from the experiment show that the proposed XAI framework achieves an accuracy of 88% and a precision of 96% on both datasets. The experimental results confirm that the XAI framework outperforms most state-of-the-art works in terms of accuracy and F1-score on both datasets. The work by [PERSON] et al. [17] moves away from post hoc explainable methods like SHAP and LIME, creating explanations based on entropy-based measures like information gain for selecting those features important in the prediction process. Additionally, the inheritance structure of a DT allows the easy creation of decision rules over those same features, which easily provide a useful interpretation of the behavior of the trained model.