  Machine Learning (ML)-based network intrusion detection systems bring many
benefits for enhancing the security posture of an organisation. Many systems
have been designed and developed in the research community, often achieving a
perfect detection rate when evaluated using certain datasets. However, the high
number of academic research has not translated into practical deployments.
There are a number of causes behind the lack of production usage. This paper
tightens the gap by evaluating the generalisability of a common feature set to
different network environments and attack types. Therefore, two feature sets
(NetFlow and CICFlowMeter) have been evaluated across three datasets, i.e.
CSE-CIC-IDS2018, BoT-IoT, and ToN-IoT. The results showed that the NetFlow
feature set enhances the two ML models' detection accuracy in detecting
intrusions across different datasets. In addition, due to the complexity of the
learning models, the SHAP, an explainable AI methodology, has been adopted to
explain and interpret the classification decisions of two ML models. The
Shapley values of the features have been analysed across multiple datasets to
determine the influence contributed by each feature towards the final ML
prediction.
