## 5 Experiments and Results
### Enhancing Model Explainability and Transparency with SHAP and LIME
#### 5.5.3 LIME  
Local Behavior Analysis  
We apply the LIME (Local Interpretable Model-agnostic Explanations) method to interpret the individual predictions made by the XGBoost model. The explanation consists of three main sections and also utilizes a consistent color scheme throughout:  
* The estimated prediction for this given instance is displayed on the left. * The middle part highlights the most significant features, with blue color representing Benign Class (0) and orange color representing Attack Class (1). The relevance of these features is assessed using floating-point numbers. * The last part displays the actual values of the most relevant variables. For Sample 1, the LIME plot is shown in Figure 13, with the final prediction being \"Benign traffic\". The following conclusions can be drawn:
* The features such as \"IAT\", \"rst_count\", \"Std\", \"rst_flag_number\", and \"flow_duration\" are indicated by the blue color, highlighting their negative contribution to the prediction. These features seem to move the classification away from \"Benign\" traffic. * Conversely, \"Rate\", \"HTTPS\", \"HTTP\", \"fin_count\", and \"syn_flag_number\" are shown in orange color. These features have a positive influence, supporting the prediction of the traffic as \"Benign\". For example, a higher \"Rate\" (rate of packet transmission) is typically observed in legitimate network traffic, while high \"HTTPS\" and \"HTTP\" traffic often point to genuine web traffic. Additionally, values of \"fin_count\" and \"syn_flag_number\" within normal ranges suggest regular TCP connection behavior, all contributing to the \"Benign\" classification. * The high value of \"rst_count\" suggests the frequent occurrences of reset packets. This typically indicates network problems or potential malicious activity and, therefore, negatively impacts the classification of traffic as \"Benign\". * The low value of \"IAT\" indicates that the packet is sent in rapid succession. This value is commonly associated with benign traffic, suggesting regular, uninterrupted communication. However, in this context, the model may associate such frequent transmission patterns with anomalous behavior, thus negatively affecting the prediction for \"Benign\" traffic. The model likely learned from training data that rapid packet transmission often correlates more with attack traffic than benign traffic, which is why it is marked in blue. Figure 12: SHAP force plot for testing Sample 2 (Local Explanation)—predicting “Class 1—Attack Traffic”. Compared to SHAP, which identifies 20 characteristics, the LIME plot only indicates 10 of the 40 features as relevant and influential. The targeted approach of LIME aids decision-making by emphasizing the key factors that influence the model's predictions for specific cases. By identifying these important elements, LIME provides a deeper understanding of the logic behind the model's results, leading to more accurate and informed decisions. Figure 14 presents the LIME plot for Test Sample 2, with the prediction of \"Attack\". The plot illustrates how different features influence the model's prediction, with blue features indicating typical traffic behavior and orange features supporting the classification of the traffic as an attack. From this, the following conclusions can be drawn:  
* The orange-highlighted features (\"syn_flag_number\", \"rst_flag_number\", \"IAT\", \"rst_count\", and \"ARP\") contribute positively to the prediction of \"Attack\" traffic. This suggests that these features increase the probability of classifying the traffic as malicious. For instance, a higher number of SYN and reset flags may indicate disruptive network activity, while a longer inter-arrival time (IAT) and more TCP resets may signal abnormal or suspicious behavior. * The blue-highlighted features (\"flow_duration\", \"duration\", \"variance\", and \"fin_count\") contribute negatively to the prediction of \"attack\".