## 5 Results and Discussion
### LSTM Model Explanation  
In this subsection, we employ the explanation methods (LIME, SHAP, Anchor, and LORE) to explain the predictions of the LSTM model. We follow the procedures in Algorithm 1 to explain the 18 classes of CIC datasets. Although the explanations of the same class using several explanation methods differ due to the differences in the explanation mechanism of these methods, they can intersect in several features. Figure 6 shows the heatmaps of intersections between the explanations of each class. The intersection size is in the range [0, 1]. The value 0 refers to no overlap between the explanations, whereas 1 indicates full overlap. We observe a high overlap (0.93-0.95) between the SHAP and Anchor explanations for CICIDS2017 classes and a low overlap (0.30-0.52) between the LIME and LORE explanations for these classes. LORE and Anchor have a 0.72 overlap in the HOIC class and 0.70 for LOIChttp class, while LIME and \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Dataset** & **Class** & **Accuracy** & **Precision** & **Recall** & **F1-Score** \\ \hline \multirow{3}{*}{CICIDS2017} & **Benign** & 0.998 & 0.997 & 0.997 & 0.998 \\ \cline{2-6}  & **Attack** & 0.998 & 0.998 & 0.997 & 0.997 \\ \hline \multirow{3}{*}{CICIDS2018} & **Benign** & 0.998 & 0.998 & 0.998 & 0.998 \\ \cline{2-6}  & **Attack** & 0.997 & 0.997 & 0.997 & 0.997 \\ \hline \multirow{3}{*}{CICDDoS2019} & **Benign** & 0.997 & 0.998 & 0.998 & 0.998 \\ \cline{2-6}  & **Attack** & 0.998 & 0.998 & 0.997 & 0.998 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Binary classification performance on all CIC datasets. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Dataset** & **Class** & **Accuracy** & **Precision** & **Recall** & **F1-Score** \\ \hline \multirow{3}{*}{CICIDS2017} & **Benign** & 0.95 & 0.99 & 0.95 & 0.97 \\ \cline{2-6}  & **GoldenEye** & 0.98 & 0.99 & 0.98 & 0.98 \\ \cline{2-6}  & **Hulk** & 0.99 & 0.96 & 0.99 & 0.98 \\ \cline{2-6}  & **Slowhttp** & 0.98 & 0.97 & 0.98 & 0.98 \\ \cline{2-6}  & **Slowloris** & 0.97 & 0.97 & 0.97 & 0.97 \\ \hline \multirow{3}{*}{CICIDS2018} & **HOIC** & 1.00 & 1.00 & 1.00 & 1.00 \\ \cline{2-6}  & **LOChttp** & 0.98 & 1.00 & 0.99 & 0.99 \\ \hline \multirow{3}{*}{CICDDoS2019} & **DNS** & 0.60 & 0.56 & 0.60 & 0.58 \\ \cline{2-6}  & **LDAP** & 0.34 & 0.56 & 0.34 & 0.42 \\ \cline{2-6}  & **MSSQL** & 0.97 & 0.95 & 0.97 & 0.96 \\ \cline{2-6}  & **NTP** & 0.99 & 0.99 & 0.99 & 0.99 \\ \cline{2-6}  & **NetBIOS** & 0.98 & 0.95 & 0.98 & 0.96 \\ \cline{2-6}  & **SNMP** & 0.84 & 0.65 & 0.84 & 0.73 \\ \cline{2-6}  & **SSDP** & 0.10 & 0.49 & 0.10 & 0.17 \\ \cline{2-6}  & **SYN** & 0.99 & 0.59 & 1.00 & 0.74 \\ \cline{2-6}  & **TFTP** & 0.98 & 0.99 & 0.98 & 0.99 \\ \cline{2-6}  & **UDP** & 0.89 & 0.48 & 0.89 & 0.62 \\ \cline{2-6}  & **UDP-Lag** & 0.20 & 0.97 & 0.20 & 0.33 \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Multiclassification performance on all CIC datasets. SHAP have only a 0.40 and 0.52 overlap for these classes, respectively. LIME and LORE explanations present high overlap (0.73-0.86) in DNS, LDAP, SNMP, and TFTP classes, while SHAP and LORE present high overlap (0.70-0.80) in MSSQL, SSDP, UDP-Lag, and NTP classes. We calculate the common features between explanations for each dataset class. Table 10 shows the common features of all dataset classes resulting from the intersection between their explanations. The number beside each class in the first column indicates a number of the common features per class. The last row lists 51 distinct features that are extracted from the union between the common features of all classes. These features are the intrinsic features we need to classify the 17 DDoS classes in Table 3.