## 5 Results and Discussion
### Evaluation of the Explanation Methods
\begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline \multirow{2}{*}{**Class**} & \multicolumn{2}{c}{**LIME**} & \multicolumn{2}{c}{**SHAP**} & \multicolumn{2}{c}{**Anchor**} & \multicolumn{2}{c}{**LORE**} \\ \cline{2-9}  & **AUDA** & **AUMAZ** & **AUDA** & **AUMAZ** & **AUDA** & **AUMAZ** & **AUDA** & **AUMAZ** \\ \hline
**Benign** & 0.6870 & **0.1034** & 0.9270 & 0.0878 & 0.9480 & 0.0853 & 0.9120 & 0.0883 \\ \hline
**GoldenEye** & 0.1030 & **0.1833** & 0.4610 & 0.1630 & 0.4780 & 0.1672 & 0.4350 & 0.0836 \\ \hline
**Hulk** & 0.0640 & **0.2703** & 0.5570 & 0.1926 & 0.4030 & 0.1915 & 0.5270 & 0.0846 \\ \hline
**Slowhttp** & 0.0420 & **0.1766** & 0.4710 & 0.1271 & 0.2480 & 0.1321 & 0.5420 & 0.0819 \\ \hline
**Slowloris** & 0.0140 & **0.1535** & 0.1790 & 0.1171 & 0.5480 & 0.1295 & 0.4660 & 0.0840 \\ \hline
**HOIC** & 0.0070 & **0.1375** & 0.8440 & 0.1021 & 0.6850 & 0.1304 & 0.0003 & 0.1132 \\ \hline
**LOIChtp** & 0.0125 & **0.1746** & 0.3926 & 0.1479 & 0.2673 & 0.1341 & 0.3354 & 0.1487 \\ \hline
**DNS** & 0.0465 & **0.1638** & 0.3498 & 0.1586 & 0.2766 & 0.1459 & 0.1692 & 0.1556 \\ \hline
**LDAP** & 0.0391 & 0.1638 & 0.1854 & 0.1620 & 0.3833 & 0.0891 & 0.0162 & **0.1733** \\ \hline
**MSSQL** & 0.0001 & **0.1944** & 0.0029 & 0.1570 & 0.0092 & 0.1209 & 0.2702 & 0.1573 \\ \hline
**NTP** & 0.0849 & 0.1402 & 0.3324 & **0.1636** & 0.6911 & 0.1601 & 0.5037 & 0.1556 \\ \hline
**NetBIOS** & 0.2721 & 0.0974 & 0.1259 & 0.1636 & 0.1053 & 0.1511 & 0.0449 & **0.1647** \\ \hline
**SNMP** & 0.0378 & 0.1620 & 0.4033 & **0.1694** & 0.3029 & 0.1634 & 0.0316 & 0.1573 \\ \hline
**SSDP** & 0.0066 & 0.1392 & 0.0001 & 0.1619 & 0.0077 & **0.1830** & 0.0237 & 0.1689 \\ \hline
**SYN** & 0.0202 & 0.0980 & 0.6977 & 0.1570 & 0.7653 & **0.1944** & 0.1313 & 0.1710 \\ \hline
**TFTP** & 0.0737 & 0.1492 & 0.2338 & 0.1604 & 0.0030 & **0.1885** & 0.0303 & 0.1711 \\ \hline
**UDP** & 0.0215 & 0.1002 & 0.0034 & 0.1619 & 0.3604 & **0.1714** & 0.3164 & 0.1647 \\ \hline
**UDP-Lag** & 0.0568 & 0.1035 & 0.1180 & 0.1636 & 0.1748 & 0.1074 & 0.0304 & **0.1689** \\ \hline \hline \end{tabular}
\end{table} 
Table 14: Area under the DA (AUDA) and area under the MAZ (AUMAZ) of all classes of CIC datasets. The colored values are encoded to (Bold Blue: lowest AUDA), (Bold Orange: largest AUDA), and (Bold Red: largest AUMAZ). Figure 9: Average descriptive accuracy (ADA) score on each class of CIC datasets. # refers to the number of removed features. each class according to the explanation method that is listed in the second column of Table 15. We can extract 42 unique features from this table. We note that the features that have a strong contribution to the prediction in most classes are captured using the LIME explanation method based on the lowest value of AUDA. We also note from Table 15 that LIME is good for capturing dominating features for classes that have less confusion with other classes. We also need to assign the relevance of features that impact a prediction to obtain a good explanation. Thus, we use the MAZ score defined in Table 7 to evaluate the explanation methods by investigating the sparsity of the generated explanations. Sparse explanations have a steep slope in MAZ near 0 and are constant around 1, as most of the features are not marked as relevant, while the denes explanations have a slow slope in MAZ near 0. Figure 10 shows the result of the MAZ calculation for all dataset classes and explanation methods. The horizontal axis represents the interval size of the MAZ window around zero, while the vertical axis is the MAZ output value. We observe that LIME shows steep slopes of the MAZ curve for nine dataset classes. These classes are Benign, GoldenEye, Hulk, Slowhttp, Slowloris, HOIC, LOIChttp, DNS, and MSSQL. The Anchor exhibits steep slopes of the MAZ curve for SSDP, SYN, TFTP, and UDP. The MAZ curves of LDAP and NetBIOS classes show steep slopes with the LORE method. The SHAP exhibits steep slopes of the MAZ curve on NTP and SNMP classes.