## 4 Methodology
### Evaluation of Classification and Explanation Models  
We evaluate both binary and multiclassification LSTM models on CIC datasets. The performance metrics are different between binary and multiclass cases. For a binary LSTM classifier, we define one of the labels as positive and the other as negative. Choosing the class \"Benign\" as negative and \"Attack\" as positive produces the following nomenclature: True Positive (\(TP\)) is the number of attack instances that are classified as an attack; True Negative (\(TN\)) is the number of benign instances that are classified as benign; False Positive (\(FP\)) is the number of benign instances that are classified as an attack; and False Negative (\(FN\)) is the number of attack instances that are classified as benign. For a multiclass classifier, \(TP_{i}\) is the number of instances correctly classified with the label of \(i\). \(FP_{i}\) are instances classified as label \(i\), but they belong to another class. \(FN_{i}\) are the instances of \(i\), but mistakenly classified in another class. Table 6 shows the performance metrics: ACC, PR, RE, and F1-score in both binary and multiclassification. \(T\) is the number of instances in the test set, and \(C\) is the number of classes in the dataset.  
As we implement several explanation methods, each with different explanation techniques, the outputs of the implemented methods for certain predictions are expected to differ. Therefore, we need to compare and evaluate the results of the used explanation methods to figure out those that explain the predictions of our classification models effectively. The evaluation of the explanation model introduces two evaluation metrics [41; 52]: Descriptive Accuracy (DA) and Descriptive Sparsity (DS).  
DA measures the accuracy of the explanation method in capturing the relevant features to the classification model prediction. As shown in Table 7, DA is obtained by removing the \(k\) most relevant features \(x_{1},\ldots,\ x_{k}\) from the instance \(x\), then finding the new prediction using the classification function \(f\) and calculating the score of the prediction class \(c\) in the absence of the \(k\) features. Removing the relevant features from an instance will decrease accuracy as the classification model has less information to make a correct prediction. The steep decline in the accuracy indicates that the removed features have the dominant contribution to the prediction, while the gradual decline indicates the dependency between the set of removed features in making the prediction.  
DS metric is used to assign a high relevance to the features that have an effect on a prediction in good explanations [41]. To calculate this metric, we scale the relevance values to the range \([-1,1]\), we then compute a normalized histogram \(h\) of these values, and finally, we calculate the mass around zero (MAZ), as shown in Table 7. The MAZ works as an increasing window that begins from 0 and keeps extending uniformly in opposite directions (positive and negative). The fraction of relevance values located in each window is assessed. Sparse explanations are identified by having a steep rise in MAZ value near 0 and are almost constant around 1 because of the fact that most of the features are not considered relevant. On the other hand, dense explanations are identified by having an outstanding smaller slope near 0, which indicates a significant set of relevant features.