## 6 Conclusions  
In this paper, we investigate the explanation of predictions of the DL model on the CIC datasets. In particular, we employ LIME, SHAP, Anchor, and LORE explanation methods to explain the LSTM that is used to classify DDoS attacks in CICIDS2017, CSECICIDS2018, and CICDDoS2019 datasets. We conduct binary and multiclass classification. The result of binary classification on all three datasets demonstrates high values of the performance metrics, while the result of multiclass classification shows good performance only on the CICIDS2017 and CSECICIDS2018 datasets and some classes of CICDDoS2019. The LSTM model has confusion in distinguishing between some attacks in CICDDoS2019, which results in low classification performance.  
LIME, SHAP, Anchor, and LORE explanation methods are used to interpret the predictions of the LSTM model. We employ these methods to explain the multiclass classification of 17 DDoS attacks that are extracted from the three CIC datasets. We find the intersection between the four explanations of each class to extract 51 features that represent the intrinsic classification features of DDoS attacks in CIC datasets. We also employ the similarity between the class explanations to unify the DDoS attacks and improve the LSTM classification performance. An explanation of classes in the CICDDoS2019 is used to improve LSTM performance.  
We finally compare and evaluate the explanation methods using DA and DS metrics. The DA is used to determine the explanation methods that can capture the dominant contribution features to the prediction of a classification model. Removing these features from the input instance can cause a steep dropping in the prediction. Our results show that the LIME method can capture such features, and it is good to capture dominating features for classes that have less confusion with other classes. The features that are captured using Anchor and SHAP methods in most DDoS classes show a gradual decline in accuracy (DA) after removing them. These methods can capture the dependent features. Our results on the DS metrics show that the dominant contribution features captured by the LIME have less dependency between them, and the features captured by Anchor and SHAP are more dependent. In future work, we will focus on more explanation methods to interpret the recent black-box models that are used to detect the wide spectrum of attacks that threaten network security.  
Conceptualization, A.B., H.B. and B.A.; methodology, A.B.; software, A.B.; validation, A.B.; formal analysis, A.B.; investigation, A.B.; resources, B.A.; data curation, A.B.; writing--original draft preparation, A.B.; writing--review and editing, B.A. and H.B.; visualization, A.B.; supervision, B.A. and H.B.; project administration, B.A. and H.B.; funding acquisition, B.A. All authors have read and agreed to the published version of the manuscript.  
This work was supported by the International Scientific Partnership Program of King Saud University under Grant ISPP-18-134(2).  
Not applicable.  
**Data Availability Statement:** Publicly available datasets were analyzed in this study. This data can be found here: [[[https://www.unb.ca/cic/datasets/index.html](https://www.unb.ca/cic/datasets/index.html)]([https://www.unb.ca/cic/datasets/index.html](https://www.unb.ca/cic/datasets/index.html))] (accessed on 17 July 2023).  
The authors declare no conflict of interest.