## 4 Results and Discussion
Overall, SHAP explainability showed that ANN predictions generally contributed more to anomaly classification, but in cases where ANN was uncertain, SVM votes tipped the decision. This interpretability is critical in cybersecurity contexts where understanding each alert's origin helps prevent alert fatigue and improve incident response. The SHAP force plot (Figure 10) provides a local explanation for a single prediction made by the ensemble model by breaking down the model output into additive feature contributions. The predicted value f(x) = 0.537 represents the model's estimated probability that the instance is an anomaly. This prediction is derived by starting from a base value, typically the mean model output over the training set, and adding SHAP values for each feature. For example, a SHAP value of +0.15 for a feature means that this feature increased the prediction by 0.15, moving it closer to the anomaly class. Conversely, a \(-\)0.15 value indicates a negative influence, pulling the prediction back toward the normal class. The final prediction is thus the sum of the base value and all SHAP contributions, allowing clear visualization of how each feature impacted the decision. The SHAP force plot shown in Figure 11 represents a single instance prediction made by the ensemble classifier using the outputs from both base learners: the ANN and the SVM. In this case, both ANN_pred and SVM_pred contributed values of 0.00, resulting in a final ensemble prediction of 0.01 (1%) probabil  
Figure 10: SHAP force plot 01. Figure 9: The precision–recall curve. 0.99 (99%) for a non-anomaly. The SHAP values indicate that the ANN output had a strong negative contribution (\(-\)0.868) to the anomaly prediction, and the SVM output contributed \(-\)0.117, both pushing the final decision toward the non-anomalous class. The force plot visually shows these contributions as blue bars pulling the prediction toward \"non-anomaly,\" reinforcing that the ensemble model confidently classified this instance as normal. This highlights how individual model outputs (even at 0.00) can strongly influence the final classification based on how the meta-classifier interprets them in context. While SHAP indeed provides insight into the contribution of input features (including ANN and SVM outputs) to the final decision, its purpose extends beyond feature ranking. In our framework, SHAP enables both global interpretability (e.g., understanding which features are generally most influential across predictions) and local interpretability (e.g., why a particular instance was classified as anomalous). This local transparency is valuable in cybersecurity, as it allows analysts to trace specific alerts back to input features, such as protocol type or failed login attempts, that contributed to a suspicious classification. Unlike traditional rule- or signature-based systems, which are static and often fail to detect zero-day threats, our SHAP-enabled system explains decisions made on previously unseen patterns, helping analysts understand model behavior in novel situations. Thus, it not only increases trust in AI decisions but also supports root cause analysis, alert prioritization, and compliance auditing in a real-time operational setting. Table 8 presents the top ten most influential features ranked by their mean absolute SHAP values, highlighting their global contribution to the ensemble model's predictions. Notably, features related to data volume (src_bytes, dst_bytes), connection frequency (count), and service diversity (same_srv_rate, diff_srv_rate) were found to have the most significant impact. These insights align with expected patterns in network behavior, where anomalies often manifest through abnormal data transfer sizes or irregular service access rates. Combined with local SHAP force plots, this feature importance table enhances interpretability and provides transparency into how the model detects anomalous traffic.