## 5 Experiments and Results
### Model Selection for XAI Technique Application  
In this section, we focus on selecting a machine learning model on which we can apply XAI techniques. It offers useful details regarding the model's decision-making process for determining whether network traffic is an attack or benign. To achieve this, we compare the two highest-performing models--XGBoost and Random Forest--evaluate their consistency in predicting network traffic, and identify key features used in the classification. Both models are evaluated further by creating feature importance lists that order the features from the most to least significant and feature importance plots that highlight the value of each feature. These plots and lists identify the key features the models rely on to predict whether the traffic is benign or an attack. This analysis reveals the specific features that the models consider crucial for determining whether the traffic is benign or an attack. By comparing the models, we determine how aligned they are in their predictions. If both models use the same features for classification, we can confidently conclude that these features are indeed critical in determining the predicted outcome. Figure 7 illustrates a feature importance plot for the XGBoost model, showcasing the ranking of features that significantly influence the model's predictions. This ranking is crucial for identifying the most important features and can help in making decisions about feature retention or removal for optimal model performance. According to the plot, the most important feature that contributes to the output result is Feature 15 (rst_count), followed by Features 32 (IAT) and 37 (Variance). Features not listed in the importance ranking have a score of zero, indicating no impact on the model's predictions, allowing for streamlined refinement. Despite having a slightly lower accuracy of 94.04% than the XGBoost model, the Random Forest model consistently found Feature 15 (rst_count) to be the most relevant and influential, followed by Feature 32 (IAT), as Figure 8 illustrates. The significance of these variables in reaching high accuracy levels is made apparent by their consistent prominence, which highlights the crucial role they play in the models' predictions. Figure 7: Feature importance plot for XGBoost and corresponding feature importance scores. Table 4 illustrates the top six features identified by both XGBoost and Random Forest, revealing a convergence in feature importance between the two models. The alignment between XGBoost and Random Forest emphasizes the significance of \"rst_count\" (the number of TCP reset packets in network traffic) in identifying patterns associated with connection resets, which are commonly linked to denial-of-service or scanning attacks. Similar to this, \"IAT\" is essential for identifying atypical traffic patterns, including unexpectedly long or short packet intervals. For instance, a rapid increase in IAT might be a sign of a DDoS assault, in which a network is overloaded by sending many packets at erratic intervals. An abnormally low IAT, on the other hand, might indicate a Brute-Force assault, which is defined by quick, consecutive efforts to compromise a system. Other variables, such as \"flow_duration\" and \"HTIPS\", are also required for detecting network traffic since they give important information about the type of communication. The \"flow_duration\" monitors the duration of the connection, which aids in detecting abnormalities such as abnormally short connections, and may indicate a DoS assault. The feature \"HTIPS\" shows whether the traffic is secure or not, as the attackers frequently target unencrypted traffic, and normal exchanges are usually encrypted. Therefore, by including these indicators, the model can better distinguish between typical and suspicious traffic, improving its capacity to detect both benign and attack network traffic.