## 4 Results
### Evaluation Results
The various colors within each bar denote different attack classes, showing the impact of each class on the significance of the feature. For example, a long segment of color within a feature's bar suggests that the corresponding attack class plays a substantial role in the model's evaluation of that feature. This detailed portrayal helps us not only understand the overall global significance of each feature for the AI model but also appreciate the distinct contribution of each feature to individual attack classes. Ultimately, these visuals assist in extracting both the top model-specific features and the top attack-specific features. Further visualizations, such as the waterfall graphs and beeswarm plots in Figures A7 and A8, can also provide analysts with a deeper understanding of the relationships between raw values and SHAP values. Figure 4: An example of the enhancement of the explanation of the AI model’s decision-making using our XAI framework versus a black-box AI model. Figure 5: Feature significance determined by the global summary plot (via SHAP) for each intrusion detection AI model utilized with the RoEduNet-SIMARGL2021 dataset. This plot also delineates the importance of each feature according to the attack type, represented by various colors. (**a**) DNN; (**b**) RF; (**c**) LightGBM; (**d**) SVM; (**e**) KNN; (**f**) ADA. Figure 6: Feature significance illustrated through a global summary plot (created using SHAP) for each AI model designed for intrusion detection with the CICIDS-2017 dataset. This visualization also highlights the importance of each feature by attack type, indicated by varying colors. (**a**) DNN; (**b**) RF; (**c**) LightGBM; (**d**) SVM; (**e**) KNN; (**f**) ADA. **(b)**: **Global Beeswarm Plot:** Another visualization that we employ is the global beeswarm plot, which displays various influential features. In contrast to the global summary plot, this plot provides a heatmap indicating the correlation between these features' values and the AI model's predictions (whether the features' values are proportional or inversely proportional to the AI's decision). In beeswarm plots (Figures 15 and 16), each data instance is represented by a dot on the plot, with the corresponding intrusion features on the left-hand side. The SHAP value of each point determines its horizontal placement, with higher values placed farther away from the center. Additionally, points with a high density are vertically stacked. By observing the distribution of these points, an analyst can gain insight into how a feature may impact the prediction. The color bar on the right-hand side of the plot indicates the raw value of each instance, with high values shown in red and low values in blue. Consequently, the analyst can comprehend the correlation between SHAP values and raw values by analyzing both the distribution and color. For example, TCP_WIN_MSS_IN (TCP window size) is the most important intrusion feature, on average, for SVM, with higher values indicating the possibility of an attack. For brevity, Appendix E includes beeswarm plots for our three datasets. **Overall Feature Importance across Different AI Models Based on XAI:** Upon evaluating the feature importance within each intrusion detection AI model, we identify the most influential features across all models. These are the features that consistently impact decision-making across various AI models in all our network intrusion datasets. Table 4 lists the top eight features for each dataset. For instance, features such as TCP_WIN_SCALE_IN, Destination Port, and dst_host_same_srv_rate are key influencers in the decision processes of all AI models for the RoEduNet-SIMARGL2021, CICIDS-2017, and NSL-KDD datasets, respectively. In addition, in the RoEduNet-SIMARGL2021 dataset, features related to TCP window settings, such as TCP_WIN_MSS_IN and TCP_WIN_SCALE_IN, are highlighted as significant. This indicates that TCP window configurations play a crucial role in assessing network behavior and detecting anomalies.