## 4 Results and Discussion
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Rank** & **Feature** & **Mean SHAP Value** & **Description** \\ \hline \multirow{2}{*}{1} & \multirow{2}{*}{src\_bytes} & \multirow{2}{*}{0.1423} & \multicolumn{2}{c}{Bytes transferred from source to} \\  & & & destination; indicates data volume sent \\  & & & by host. \\ \hline \multirow{2}{*}{2} & \multirow{2}{*}{dst\_bytes} & \multirow{2}{*}{0.1376} & \multicolumn{2}{c}{Bytes transferred from destination to} \\  & & & source; reflects server-side response. \\ \hline \multirow{2}{*}{3} & \multirow{2}{*}{count} & \multirow{2}{*}{0.1198} & Number of connections to the same host \\  & & & within a 2 s window. \\ \hline \multirow{2}{*}{4} & \multirow{2}{*}{same\_srv\_rate} & \multirow{2}{*}{0.1082} & Percentage of connections to the \\  & & & same service. \\ \hline \multirow{2}{*}{5} & \multirow{2}{*}{diff\_srv\_rate} & \multirow{2}{*}{0.0974} & Rate of connections to different services; \\  & & & high values may indicate scanning. \\ \hline \multirow{2}{*}{6} & \multirow{2}{*}{protocol\_type} & \multirow{2}{*}{0.0921} & Protocol used (e.g., TCP, UDP); can hint \\  & & & at abnormal protocol usage. \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Top 10 most influential features based on SHAP values. Figure 11: SHAP force plot 02. Nonetheless, to provide a more comprehensive evaluation, we extended our experimental analysis to include two widely recognized state-of-the-art (SOTA) ensemble learning techniques: XGBoost (Extreme Gradient Boosting) and AdaBoost (Adaptive Boosting). Both models were trained and evaluated using the same preprocessed NSL-KDD dataset and standardized feature set used in our proposed ensemble. XGBoost, known for its superior accuracy and handling of imbalanced data, achieved a classification accuracy of 98.70%, with strong precision and recall. AdaBoost, a boosting method that sequentially emphasizes misclassified instances, yielded 97.90% accuracy. Although these results are competitive, our proposed ANN + SVM + RF ensemble surpassed both, with 99.40% accuracy, while also offering real-time deployment capabilities and explainability through SHAP integration. Moreover, neither XGBoost nor AdaBoost was optimized for interpretability or real-time deployment, which limits their practical utility in operational cybersecurity environments. This highlights the robustness, transparency, and deployability of our proposed approach. To further validate the results using the most recent data, an additional experiment was conducted on the UNSW-NB15 dataset [37; 38], employing a similar methodology. This dataset includes nine distinct attack categories: Fuzzers, analysis, backdoors, DoS, exploits, generic, reconnaissance, shellcode, and worms. The proposed ensemble model demonstrated strong generalization capabilities, achieving a binary classification accuracy of 99.80%, outperforming individual base learners such as ANN (98.30%) and SVM (95.60%). These results are comparable to, and, in some cases, exceed, those reported in prior studies [37; 38]. The corresponding confusion matrix (Figure 12) and ROC curve (Figure 13) further illustrate the model's high precision and robust discriminative performance on the UNSW-NB15 dataset. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Rank** & **Feature** & **Mean SHAP Value** & **Description** \\ \hline
7 & flag & 0.0847 & TCP flag status; used to detect connection behavior. \\ \hline
8 & dst\_host\_srv\_count & 0.0763 & Connections to the same service on the destination host. \\ \hline
9 & dst\_host\_same\_srv\_rate & 0.0689 & Rate of same service usage across connections to the destination host. \\ \hline
10 & dst\_host\_diff\_srv\_rate & 0.0615 & Rate of different services across connections to destination host. \\ \hline \hline \end{tabular}
\end{table} 
Table 8: _Cont._