## 5 Experiments and Results
### Enhancing Model Explainability and Transparency with SHAP and LIME
#### 5.5.2 SHAP--Local Behavior Analysis  
The global summary plot of SHAP provides a comprehensive overview of feature relevance over the whole dataset, indicating which factors have the most and least effect on the model's predictions. However, it does not clarify how these attributes influence each prediction or why the model made a certain conclusion for a single data point. This constraint emphasizes the need for local analysis, which gives instance-specific knowledge of feature contributions, thereby improving the model's interpretability and dependability. To demonstrate this, we use the local summary plot of SHAP to evaluate and visualize each feature contribution, to the final prediction, offering a deeper understanding of the model's decision-making procedure for specific instances. Figure 10 depicts the SHAP local summary graphic, with red and blue hues denoting high and low feature values. Features are ordered based on their impact on the model's output, with \"rst_count\" having the most impact and \"Protocol Type\" having the least. Figure 10 clearly illustrates a \"Benign\" class prediction, whereas Figure 10 clearly represents an \"Attack\" classification. After analyzing the top five features from SHAP local summary plot--\"rst_count\", \"IAT\", \"urg_count\", \"Header_Length\", and \"flow_duration\", the following conclusions can be drawn:  
* Higher values of \"rst_count\" can signal abnormalities or possible assaults, whereas a low number denotes fewer network resets, which are frequently linked to benign traffic. * Longer packet intervals, which are characteristic of benign traffic, are indicated by a high \"IAT\" (Inter-Arrival Time) value. On the other hand, a low number of \"IAT\" can indicate a pattern of unusual activity, such as DoS assaults. * While a large value of \"urg_count\" can signify anomalous activity or possible attacks, a low value indicates fewer urgent packets, which is typical in innocuous traffic. * Standard packets typically have a small value of \"Header_Length\"; however, a large value might suggest the existence of malicious activity or specialized protocols. * Longer \"flow duration\" denotes genuine connections, whereas an infrequent one can imply possible malicious exchanges. Figure 10: Local analysis using the SHAP summary plot: (**a**) illustration of a “Benign” class prediction for Sample 1 and (**b**) illustration of an “Attack” class prediction for Sample 2. To further analyze individual test instances (Sample 1 and Sample 2), we employ SHAP force plots, which provide a detailed view of how each attribute influences a particular prediction. The plot's base value represents the average model output across the training dataset, serving as a starting point to understand the impact of each feature on the prediction. Positive contributions are shown by red bars, while negative contributions are represented by blue bars. The length of each bar indicates the extent of the feature's contribution and its influence, with wider bars implying a greater effect. The final prediction, shown at the end of the figure, represents the cumulative effect of all the feature's contributions beginning from the base value. Figure 11 shows the SHAP force plot for Sample 1, and the following conclusions have been drawn from it:  
* The attributes--\"rst_count\", \"HTTPS\", \"urg_count\", \"Radius\", \"ack_flag_number\", \"flow_duration\", and \"Header_Length\"--are displayed in red, collectively pushing the prediction score from the base value of 0.49 towards a higher value, thereby supporting the model's classification of the network traffic as \"Benign\". * The red color signifies a positive contribution to the final outcome or prediction. For example, higher values of \"rst_count\" may point to typical session terminations rather than suspicious activities, suggesting benign traffic. Similarly, higher values of \"HTTPS\" are commonly linked with legitimate and secure communication, further indicating that the traffic is benign.