## 4 Methodology
### Explanation Models  
The explanation methods are used to interpret classification model predictions. In this paper, LIME, SHAP, Anchor, and LORE are used to interpret the predictions of the LSTM model. These methods are model agnostic and work under the assumption that no information is available about the classification model or its parameters. Technically, these methods depend on an approximation of the classification function, which leads them to figure out how the input instances contribute to a classification prediction. The explanation model utilizes the relevance between the input instances and the prediction of the classification model to identify important features and highlight the top features that contribute to the predicted accuracy of the classification model.  
To provide the reader with an example of the outputs of explanation methods, in Table 5, we present explanations of the GoldenEye attack for an arbitrary instance selected from the CICIDS2017 dataset. We display only the top 10 important explanations for each explanation model. The numbers beside the features in LIME and SHAP represent the weight of the feature.  
We exploit the explanation methods to interpret the prediction of DDoS attacks and benign classes within CIC datasets. Algorithm 1 shows the procedures we follow to implement the classification and the explanation of each class in the CIC datasets. The input of Algorithm 1 is the test instances \(X\), and the output is the explanation vector \(V_{c}\). Each instance \(x\) from \(X\) is fed to the LSTM model, which is trained on 18 classes of the train set, to predict \(c^{\prime}\).  
We then select only the input instances that are correctly classified (e.g., \(c^{\prime}=c\)) and add them to vector \(S\). We then use LIME, SHAP, Anchor, and LORE explanation methods to explain each instance \(x_{i}\) in \(S\). The output of an explanation method \(x^{\prime}\) is added to vector \(V\). We finally extract the distinct features in each explanation \(V_{c}\) by taking \(\text{unique}[V]\).  
Figure 3: Architecture of LSTM classification model.  
\begin{table}
\begin{tabular}{c c c} \hline \hline  & **LIME Explanations** & **SHAP Explanations** \\ \hline \multirow{4}{*}{F * (weight)} & 54 (0.114), 19 (0.097), 26 (\(-\)0.093), & 50 (0.195), 19 (0.152), 16 (0.143), 26 \\  & 50 (0.072), 16 (0.068), 58 (\(-\)0.054), & (0.130), 58 (\(-\)0.114), 46 (\(-\)0.102), \\  & 47 (0.046), 46 (\(-\)0.044), 60 (0.036), & 28 (0.073), 47 (0.071), 45 (0.069), \\  & 45 (0.032). & 60 (0.068). & 60 (0.068). \\ \hline \multirow{4}{*}{F AND F} & **Anchor Explanations** & **LORE Explanations** \\ \cline{2-3}  & 58 AND 15 AND 74 AND 45 & 50 AND 46 AND 51 AND 58 \\ \cline{1-1}  & AND 12 AND 53 AND 60 AND 18 & AND19 AND 47 AND 60 AND 43 \\ \cline{1-1}  & AND 72 AND 68. & AND 20 AND 14. \\ \hline \hline \end{tabular}  
* Feature.  
\end{table}
Table 5: Top 10 explanations of a sample of the GoldenEye attack using the explanation methods.  
The following example illustrates the explanation of the Hulk class using the LIME method:  
\[V_{c}=\left[\begin{array}{c}49,\,58,\,28,\,46,\,54,\,16,\,47,\,48,\,21,\,45,\,23,\,75,\,42,\,82,\,18,\,19,\,81,\,29,\,60,\,26,\,17,\\ 71,\,15,\,44,\,79,\,78,\,61,\,12,\,9,\,74,\,68,\,8,\,76,\,80,\,11,\,41,\,33,\,14,\,70,\,43,\,73,\,77,\,57\end{array}\right]\]  
where \(c\) here is Hulk.