Pith. sign in

REVIEW 4 major objections 5 minor 1 cited by

Evaluating explainable AI for deep learning-based network intrusion detection system alert classification

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper argues that DeepLIFT is the most trustworthy post-hoc explainer for LSTM-based prioritization of network intrusion alerts, as measured by faithfulness, complexity, robustness, and reliability.

desk verdict Useful benchmark idea, but the headline claim is contradicted by the paper's own Table 3, and the LSTM is underspecified; needs major revision before it can support a DeepLIFT recommendation. read the letter →

arxiv 2506.07882 v1 pith:REMWPFX4 submitted 2025-06-09 cs.CR

Rajesh Kalakoti , Risto Vaarandi , Hayretdin Bahsi , Sven Nõmm This is my paper
classification cs.CR
keywords explainableAInetworkintrusiondetectionalertprioritizationLSTMDeepLIFTfeatureattributionsecurityoperationscenterXAIevaluation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that post-hoc explainability for deep-learning-based NIDS alert prioritization can be evaluated on four criteria, and that one method, DeepLIFT, dominates the others. Using a real 60-day Suricata alert log from a university security operations center, the authors train an LSTM to classify alert groups as important or irrelevant, then compare LIME, SHAP, Integrated Gradients, and DeepLIFT. They claim DeepLIFT consistently wins on every evaluation metric, and that its top features overlap with the five features SOC analysts identify as most important. If the claim holds, security operations centers can adopt DeepLIFT as a default explainer for LSTM-based alert triage without sacrificing fidelity to the model's decision process.

What carries the argument

The central mechanism is the combined evaluation framework: an LSTM classifier for alert-group priority, four feature-attribution explainers (LIME, SHAP, Integrated Gradients, DeepLIFT), and a four-criterion scorecard made of named metrics—high faithfulness correlation, monotonicity, max sensitivity, low-complexity entropy, relevance mass accuracy, and relevance rank accuracy. The reliability metrics use a ground-truth mask built from the five features that TalTech SOC analysts identified as essential for alert significance, turning each explainer's attribution vector into scalar scores that can be compared across 2000 test points.

What would settle it

Train the same LSTM on versions of the same alert data with randomly permuted time-step order, then recompute classification accuracy and the four explanation metrics; if accuracy and DeepLIFT's advantage remain essentially unchanged, the claimed temporal structure is irrelevant and the comparison describes a model that did not need to be an LSTM. A second, stronger check is to run the same evaluation on a different SOC's alert dataset and see whether DeepLIFT still wins on reliability.

Watch

Extended reading notes

Core claim

The authors claim that DeepLIFT, which propagates activation differences from a reference input, produces explanations for the LSTM's alert-priority decisions that are more faithful, more robust, less complex, and more reliable than LIME, SHAP, and Integrated Gradients. Concretely, DeepLIFT achieves the highest high-faithfulness correlation (0.7559), the lowest max sensitivity (0.0008), low complexity (2.2635), and the best reliability scores against the analyst-defined ground truth (relevance mass accuracy 0.7812, relevance rank accuracy 0.6754). Pairwise Wilcoxon signed-ranks tests show significant differences favoring DeepLIFT across all metrics. The paper further claims that global SHAP analysis ranks the SOC-analyst-identified features among the most impactful, validating the practical usefulness of the explanations.

Load-bearing premise

The load-bearing premise is that the LSTM processes a meaningful time-ordered sequence, but the paper never states how the static alert-group feature vectors are converted into sequences, so if that ordering is arbitrary the entire model and its explanations rest on an unjustified inductive bias.

Editorial extensions

If this is right

  • For LSTM-based NIDS alert triage, DeepLIFT is the recommended post-hoc explainer among the four tested in this study.
  • The four-metric framework can be reused by SOC engineers to benchmark explainability tools before deployment.
  • Analyst-identified features such as SignatureMatchesPerDay, Similarity, SCAS, SignatureID, and SignatureIDSimilarity can serve as a practical ground truth for checking explanation reliability.
  • Explanation quality can be assessed independently of model accuracy, so SOCs may not need to trade detection performance for transparency.
  • The statistical comparison procedure offers a template for future studies selecting among explainable-AI methods.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: if the LSTM's input sequences were constructed arbitrarily from static alert-group records, the four explainers may be describing a model that does not actually exploit temporal structure; a natural check is to retrain on randomly shuffled sequences and see whether the classification performance and DeepLIFT's advantage persist.
  • Editorial inference: the conclusion may transfer to other sequence models such as GRUs or transformers only if reference-based propagation methods behave similarly on their attributions; this is a testable extension beyond the paper.
  • Editorial inference: the reliability scores depend on the five analyst-selected features; at a different SOC with a different ground-truth feature set, the ranking of explainers could shift.
  • Editorial inference: DeepLIFT's low max sensitivity suggests it may produce stable explanations for streaming alert data, but this needs direct verification on online, non-static inputs.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper evaluates four post-hoc feature-attribution XAI methods (LIME, SHAP, Integrated Gradients, DeepLIFT) for explaining an LSTM model trained to prioritize NIDS alerts from a real SOC dataset. It introduces a four-criterion evaluation framework (faithfulness, complexity, robustness, reliability), applies pairwise Wilcoxon tests, and claims that DeepLIFT consistently outperforms the other methods across all criteria and that XAI feature rankings agree with features identified by SOC analysts.

Significance. If the central claim were valid, the paper would provide a practical, data-grounded recommendation for choosing an explainer for LSTM-based NIDS alert prioritization and a reusable evaluation framework. The use of a real SOC dataset, collaboration with analysts, and statistical pairwise comparisons are genuine strengths. However, the main claim is internally contradicted by the reported results, and the reliability evaluation is circular by construction; these issues prevent the paper from supporting its stated significance.

major comments (4)
  1. [Abstract, §4 Table 3, §3.4.4] The abstract and conclusion state that DeepLIFT 'consistently outperformed' the other XAI methods across the evaluation framework. This is directly contradicted by the paper's own results on the Low Complexity metric. Section 3.4.4 defines lower entropy (Eq. 14) as lower (better) complexity; Table 2 reports a mean Low Complexity of 2.1745 for Integrated Gradients versus 2.2635 for DeepLIFT, and Table 3 marks the IG-vs-DeepLIFT pairwise comparison as 'I' (IG better) with p = 1.07e-42. Thus DeepLIFT does not outperform on at least one of the four headline criteria, and the stated central conclusion is not supported by the reported evidence.
  2. [§3.2] The LSTM model is trained on alert group records, but the paper never specifies how the static feature vectors are converted into the time-ordered sequences an LSTM requires. No input shape, sequence length, feature ordering, or time-step construction is described; Eqs. (1)–(6) give only generic LSTM update equations. Since the explanations are explanations of this LSTM, the model being explained is underspecified, and the reported attributions could reflect an arbitrary or unjustified temporal structuring of the data.
  3. [§3.4.1, §4, Table 1] The Reliability metrics (RMA and RRA) use a ground truth mask constructed from the five SOC analyst features listed in Table 1, and Section 4 then presents agreement with those same analyst features as evidence validating the XAI methods. This is circular: any explainer that ranks the five analyst-selected features highly will score well on reliability, so the later 'validation' is not independent. The paper should either use a genuinely independent ground truth or explicitly frame reliability as measuring concordance with the analyst features rather than as validation of explanation correctness.
  4. [Table 2] The reported RMA standard deviations are implausibly large relative to the means: DeepLIFT has 0.7812 ± 25.2805 and LIME has 0.6234 ± 9.7008. This suggests numerical instability, extreme outliers, or an error in computation or reporting. Because RMA is one of the two reliability metrics supporting the DeepLIFT recommendation, this instability must be explained before any reliability conclusion can be accepted.
minor comments (5)
  1. [§4] The text says 'Table 5 shows the results' when the displayed table is labeled Table 2; the reference should be corrected.
  2. [§3.4.2, Eq. (12)] The faithfulness correlation definition contains malformed notation, including 'B∈( |d| |B|)' and a trailing parenthesis in 'xB = xi|i ∈ B}'; the subset-sampling procedure and baseline value should be stated clearly.
  3. [§3.4.3, Eq. (13)] The max sensitivity definition contains a garbled condition 'M (x) =M (x)(z)'; the neighborhood definition and distance metric should be written precisely.
  4. [§3.4.1] The text uses both 'Relevancy' and 'Relevance' for the same metrics; the terminology should be made consistent.
  5. [§3.2 and §4] The paper mentions '10 features' in the example explanations, but the dataset description includes a large number of AttrSimilarity fields; the total feature dimensionality used in the LSTM and in the explainers should be stated explicitly.

Circularity Check

1 steps flagged · score 5.0 of 10

Reliability validation reduces to its own metric; the faithfulness, robustness, and complexity comparisons remain independent.

  1. self definitional [Abstract; Section 3.4.1 (Reliability / RRA / RMA)]
    "The ground truth mask ([0,1]) was determined by the features SOC Analysts identified (see Table. 1). ... The strong alignment between these analyst-identified features and those obtained by the XAI methods validates their effectiveness and enhances the practical applicability of our approach."

    RRA and RMA are defined as the fraction and mass, respectively, of explanation attribution that falls inside a binary mask made of the five SOC-analyst-selected features. Consequently, 'alignment between analyst-identified features and XAI features' is the Reliability metric itself, not an independent check. The abstract and conclusions repackage this same computed overlap as an external validation ('strong alignment ... validates their effectiveness'), which is circular by construction for the reliability component. Faithfulness, robustness, and complexity are defined without reference to the analyst mask, so those axes still carry independent comparative content.

full rationale

The only genuine circular step is in the reliability leg of the evaluation. Section 3.4.1 operationalizes Reliability exclusively as RRA/RMA against a ground-truth mask derived from the five SOC-analyst features; the abstract then presents the agreement with those same features as external validation of the XAI methods. That is a self-definitional reduction: the validation metric and the reported 'alignment' are the same computation. The other three criteria—faithfulness correlation, monotonicity, max sensitivity, and low complexity—do not use the analyst mask, so the DeepLIFT comparison is not wholly circular. I also note, for completeness, that Table 3 shows Integrated Gradients significantly better than DeepLIFT on Low Complexity (p = 1.07e-42), which contradicts the 'consistently outperformed' wording, but that is an internal consistency/correctness issue rather than a circularity. No load-bearing self-citation or uniqueness-import pattern was identified; the LSTM sequence-construction omission is a reproducibility concern, not a circular step.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The analysis rests on domain assumptions about the correctness of analyst labels and analyst-chosen features, and on an unspecified LSTM sequence representation. The numerical evaluation depends on several hand-chosen parameters, including the max sensitivity radius, the RRA top-K, and the unexplained choice of 2000 evaluation points.

free parameters (4)
  • LSTM hyperparameters = not reported (found by RandomSearch)
    The model being explained depends on hidden size, layer count, learning rate, and sequence configuration; none are given, so the explained model is not fully specified.
  • Max Sensitivity radius r = 0.1
    The robustness score depends on the radius used to define the neighbourhood; the choice is not justified.
  • RRA top-K = 5
    Relevance Rank Accuracy uses K equal to the number of analyst features; changing K changes the reliability scores.
  • XAI evaluation subset size = 2000 test points out of 4000
    The paper evaluates explainers on 2000 test points while the test set has 4000; the selection rule is not described.
assumptions (5)
  • domain assumption SOC analyst features are the correct ground truth for alert significance
    Table 1 and Section 3.4.1 use these five features to build the ground truth mask for the reliability metrics; if the analysts are wrong or incomplete, RMA and RRA do not measure explanation correctness.
  • ad hoc to paper Alert records can be represented as sequences for the LSTM
    Section 3.2 gives the LSTM equations but no sequence construction; the model assumes a temporal or feature-order structure that is never stated.
  • domain assumption The four evaluation metrics validly measure explanation quality
    Section 3.4 imports faithfulness, complexity, robustness, and reliability measures from prior literature without validating them on this domain.
  • domain assumption Human labels of important vs irrelevant alerts are correct
    Section 3.1 relies on human-labeled alert groups as ground truth for training and testing; no inter-analyst agreement is reported.
  • domain assumption The TalTech SOC dataset is representative of real-world NIDS alert streams
    Section 3.1 describes 60 days of alerts from one university SOC; results may not generalize to other networks.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Evaluating explainable AI for deep learning-based network intrusion detection system alert classification." pith.science (2026). https://pith.science/paper/REMWPFX4

@misc{pith2026250607882,
  author       = {Pith},
  title        = {Pith review of: Evaluating explainable AI for deep learning-based network intrusion detection system alert classification},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/REMWPFX4}},
  note         = {Machine review of arXiv:2506.07882}
}
read the original abstract

A Network Intrusion Detection System (NIDS) monitors networks for cyber attacks and other unwanted activities. However, NIDS solutions often generate an overwhelming number of alerts daily, making it challenging for analysts to prioritize high-priority threats. While deep learning models promise to automate the prioritization of NIDS alerts, the lack of transparency in these models can undermine trust in their decision-making. This study highlights the critical need for explainable artificial intelligence (XAI) in NIDS alert classification to improve trust and interpretability. We employed a real-world NIDS alert dataset from Security Operations Center (SOC) of TalTech (Tallinn University Of Technology) in Estonia, developing a Long Short-Term Memory (LSTM) model to prioritize alerts. To explain the LSTM model's alert prioritization decisions, we implemented and compared four XAI methods: Local Interpretable Model-Agnostic Explanations (LIME), SHapley Additive exPlanations (SHAP), Integrated Gradients, and DeepLIFT. The quality of these XAI methods was assessed using a comprehensive framework that evaluated faithfulness, complexity, robustness, and reliability. Our results demonstrate that DeepLIFT consistently outperformed the other XAI methods, providing explanations with high faithfulness, low complexity, robust performance, and strong reliability. In collaboration with SOC analysts, we identified key features essential for effective alert classification. The strong alignment between these analyst-identified features and those obtained by the XAI methods validates their effectiveness and enhances the practical applicability of our approach.

Figures

Figures reproduced from arXiv: 2506.07882 by the authors.

Figure 1
Figure 1. Hidden Layer Architecture of LSTM Network [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Loss and Accuracy from Best LSTM Performance Model [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗
Figure 3
Figure 3. Confusion Matrix and Classification Report [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Explanations for an important NIDS alert data point using an LSTM model [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]
Figure 5
Figure 5. Figure 5: Quality of Explainable AI evaluation metrics distribution [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 6
Figure 6. Figure 6: SHAP global explanation for LSTM model We have also provided a global explanation using SHAP values for all the testing data of the LSTM model. A higher value positively impacts the prediction, while a lower value contributes negatively [PITH_FULL_IMAGE:figures/full_f…

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Human-Centered Explainable AI for Security Enhancement: A Deep Intrusion Detection Framework

    cs.AI 2026-02 reject novelty 3.0 of 10

    A CNN/LSTM intrusion detection framework with SHAP explanations and a 15-expert trust survey reports 99% accuracy on NSL-KDD, but its claimed superiority is unmeasured.

Reference graph

Works this paper leans on

44 extracted references · 41 canonical work pages · cited by 1 Pith paper

  1. [1]

    A performance analysis of snort and suricata network intrusion detection and prevention engines,

    David Day and Benjamin Burns, “A performance analysis of snort and suricata network intrusion detection and prevention engines,” in Fifth International Conference on Digital Society, Gosier, Guadeloupe, pp. 187–192, 2011

    work page 2011

  2. [2]

    In-depth feature selection for the statistical machine learning-based botnet detection in IoT networks,

    Rajesh Kalakoti, Sven Nõmm, and Hayretdin Bahsi, “In-depth feature selection for the statistical machine learning-based botnet detection in IoT networks,” IEEE Access, vol. 10, pp. 94518–94535, 2022

    work page 2022

  3. [3]

    Explaining network intrusion detection system using explainable AI framework,

    Shraddha Mane and Dattaraj Rao, “Explaining network intrusion detection system using explainable AI framework,” arXiv preprint arXiv:2103.07110, 2021

    arXiv 2021

  4. [4]

    A detailed analysis of the KDD CUP 99 data set,

    Mahbod Tavallaee, Ebrahim Bagheri, Wei Lu, and Ali A. Ghorbani, “A detailed analysis of the KDD CUP 99 data set,” in 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications , pp. 1–6, 2009

    work page 2009

  5. [5]

    Recent advances in trustworthy explainable artificial intelligence: Status, challenges, and perspectives,

    Atul Rawal, James McCoy, Danda B. Rawat, Brian M. Sadler, and Robert St. Amant, “Recent advances in trustworthy explainable artificial intelligence: Status, challenges, and perspectives,” IEEE Transactions on Artificial Intelligence, vol. 3, no. 6, pp. 852–866, 2021

    work page 2021

  6. [6]

    Evaluation metrics in explainable artificial intelligence (XAI),

    Loredana Coroama and Adrian Groza, “Evaluation metrics in explainable artificial intelligence (XAI),” in International Conference on Advanced Research in Technologies, Information, Innovation and Sustainability, pp. 401–413, 2022

    work page 2022

  7. [7]

    Outmet: A new metric for prioritising intrusion alerts using correlation and outlier analysis,

    Riyanat Shittu, Alex Healing, Robert Ghanea-Hercock, Robin Bloomfield, and Rajarajan Muttukrishnan, “Outmet: A new metric for prioritising intrusion alerts using correlation and outlier analysis,” in39th Annual IEEE Conference on Local Computer Networks, pp. 322–330, 2014

    work page 2014

  8. [8]

    A review of anomaly based intrusion detection systems,

    VVRPV Jyothsna, Rama Prasad, and K. Munivara Prasad, “A review of anomaly based intrusion detection systems,” International Journal of Computer Applications, vol. 28, no. 7, pp. 26–35, 2011

    work page 2011

Show all 44 references
  1. [9]

    Cloud service oriented architecture (CSoA) for agriculture through internet of things (IoT) and big data,

    Pamidi Srinivasulu, M. Sarath Babu, R. Venkat, and K. Rajesh, “Cloud service oriented architecture (CSoA) for agriculture through internet of things (IoT) and big data,” in 2017 IEEE International Conference on Electrical, Instrumentation and Communication Engineering (ICEICE)...

    2017

  2. [10]

    XAI-CF–Examining the Role of Explainable Artificial Intelligence in Cyber Forensics,

    Shahid Alam and Zeynep Altiparmak, “XAI-CF–Examining the Role of Explainable Artificial Intelligence in Cyber Forensics,” arXiv preprint arXiv:2402.02452, 2024

    2024

  3. [11]

    Explainable intrusion detection for cyber defences in the internet of things: Opportunities and solutions,

    Nour Moustafa, Nickolaos Koroniotis, Marwa Keshk, Albert Y . Zomaya, and Zahir Tari, “Explainable intrusion detection for cyber defences in the internet of things: Opportunities and solutions,” IEEE Communications Surveys & Tutorials, vol. 25, no. 3, pp. 1775–1807, 2023

    2023

  4. [12]

    Enhancing IoT Botnet Attack Detection in SOCs with an Explainable Active Learning Framework,

    Rajesh Kalakoti, Sven Nõmm, and Hayretdin Bahsi, “Enhancing IoT Botnet Attack Detection in SOCs with an Explainable Active Learning Framework,” in 2024 IEEE World AI IoT Congress (AIIoT), pp. 265–272, 2024

    2024

  5. [13]

    Featureless discovery of correlated and false intrusion alerts,

    Egon Kidmose, Matija Stevanovic, Søren Brandbyge, and Jens M. Pedersen, “Featureless discovery of correlated and false intrusion alerts,” IEEE Access, vol. 8, pp. 108748–108765, 2020

    2020

  6. [14]

    Deepcase: Semi-supervised contextual analysis of security events,

    Thijs Van Ede, Hojjat Aghakhani, Noah Spahn, Riccardo Bortolameotti, Marco Cova, Andrea Continella, Maarten van Steen, Andreas Peter, Christopher Kruegel, and Giovanni Vigna, “Deepcase: Semi-supervised contextual analysis of security events,” in 2022 IEEE Symposium on Security...

    2022

  7. [15]

    Breaking alert fatigue: AI-assisted SIEM framework for effective incident response,

    Tao Ban, Takeshi Takahashi, Samuel Ndichu, and Daisuke Inoue, “Breaking alert fatigue: AI-assisted SIEM framework for effective incident response,” Applied Sciences, vol. 13, no. 11, p. 6610, 2023

    2023

  8. [16]

    Platform design and implementation for flexible data processing and building ML models of IDS alerts,

    Iksoo Shin, Yunsoo Choi, Taewoong Kwon, Hyeakro Lee, and Jungsuk Song, “Platform design and implementation for flexible data processing and building ML models of IDS alerts,” in 2019 14th Asia Joint Conference on Information Security (AsiaJCIS), pp. 64–71, 2019

    2019

  9. [17]

    A user-centric machine learning framework for cyber security operations center,

    Charles Feng, Shuning Wu, and Ningwei Liu, “A user-centric machine learning framework for cyber security operations center,” in 2017 IEEE International Conference on Intelligence and Security Informatics (ISI) , pp. 173–175, 2017

    2017

  10. [18]

    Identifying truly suspicious events and false alarms based on alert graph,

    Tian Wang, Chen Zhang, Zhigang Lu, Dan Du, and Yaopeng Han, “Identifying truly suspicious events and false alarms based on alert graph,” in 2019 IEEE International Conference on Big Data (Big Data), pp. 5929–5936, 2019

    2019

  11. [19]

    Combat security alert fatigue with AI-assisted techniques,

    Tao Ban, Samuel Ndichu, Takeshi Takahashi, and Daisuke Inoue, “Combat security alert fatigue with AI-assisted techniques,” in Proceedings of the 14th Cyber Security Experimentation and Test Workshop, pp. 9–16, 2021

    2021

  12. [20]

    A stream clustering algorithm for classifying network IDS alerts,

    Risto Vaarandi, “A stream clustering algorithm for classifying network IDS alerts,” in 2021 IEEE International Conference on Cyber Security and Resilience (CSR), pp. 14–19, 2021

    2021

  13. [21]

    How to Build a SOC on a Budget,

    Risto Vaarandi and Sten Mäes, “How to Build a SOC on a Budget,” in 2022 IEEE International Conference on Cyber Security and Resilience (CSR), pp. 171–177, 2022

    2022

  14. [22]

    Stream clustering guided supervised learning for classifying NIDS alerts,

    Risto Vaarandi and Alejandro Guerra-Manzanares, “Stream clustering guided supervised learning for classifying NIDS alerts,” Future Generation Computer Systems, vol. 155, pp. 231–244, 2024

    2024

  15. [23]

    Axiomatic attribution for deep networks,

    Mukund Sundararajan, Ankur Taly, and Qiqi Yan, “Axiomatic attribution for deep networks,” inInternational Conference on Machine Learning, pp. 3319–3328, 2017

    2017

  16. [24]

    Learning important features through propagating activation differences,

    Avanti Shrikumar, Peyton Greenside, and Anshul Kundaje, “Learning important features through propagating activation differences,” in International Conference on Machine Learning, pp. 3145–3153, 2017

    2017

  17. [25]

    Why should I trust you? Explaining the predictions of any classifier,

    Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin, “Why should I trust you? Explaining the predictions of any classifier,” in Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp. 1135–1144, 2016

    2016

  18. [26]

    A unified approach to interpreting model predictions,

    Scott M. Lundberg and Su-In Lee, “A unified approach to interpreting model predictions,” Advances in Neural Information Processing Systems, vol. 30, 2017

    2017

  19. [27]

    Generating contrastive explanations with monotonic attribute functions,

    Ronny Luss, Pin-Yu Chen, Amit Dhurandhar, Prasanna Sattigeri, Karthik Shanmugam, and Chun-Chen Tu, “Generating contrastive explanations with monotonic attribute functions,” arXiv preprint arXiv:1905.12698, vol. 3, 2019

    1905 arXiv

  20. [28]

    Evaluating and aggregating feature-based model explanations,

    Umang Bhatt, Adrian Weller, and José M.F. Moura, “Evaluating and aggregating feature-based model explanations,” arXiv preprint arXiv:2005.00631, 2020

    2005 arXiv

  21. [29]

    CLEVR-XAI: A benchmark dataset for the ground truth evaluation of neural network explanations,

    Leila Arras, Ahmed Osman, and Wojciech Samek, “CLEVR-XAI: A benchmark dataset for the ground truth evaluation of neural network explanations,” Information Fusion, vol. 81, pp. 14–40, 2022

    2022

  22. [30]

    Improving Transparency and Explainability of Deep Learning Based IoT Botnet Detection Using Explainable Artificial Intelligence (XAI),

    Rajesh Kalakoti, Sven Nõmm, and Hayretdin Bahsi, “Improving Transparency and Explainability of Deep Learning Based IoT Botnet Detection Using Explainable Artificial Intelligence (XAI),” in 2023 International Conference on Machine Learning and Applications (ICMLA), pp. 595–601, 2023

    2023

  23. [31]

    European Union regulations on algorithmic decision-making and a “right to explanation

    Bryce Goodman and Seth Flaxman, “European Union regulations on algorithmic decision-making and a “right to explanation”,” AI Magazine, vol. 38, no. 3, pp. 50–57, 2017

    2017

  24. [32]

    Achieving explainability of intrusion detection system by hybrid oracle-explainer approach,

    Mateusz Szczepa´nski, Michał Chora´s, Marek Pawlicki, and Rafał Kozik, “Achieving explainability of intrusion detection system by hybrid oracle-explainer approach,” in 2020 International Joint Conference on Neural Networks (IJCNN), pp. 1–8, 2020

    2020

  25. [33]

    Deceiving Post-hoc Explainable AI (XAI) Methods in Network Intrusion Detection,

    Thulitha Senevirathna, Bartlomiej Siniarski, Madhusanka Liyanage, and Shen Wang, “Deceiving Post-hoc Explainable AI (XAI) Methods in Network Intrusion Detection,” in 2024 IEEE 21st Consumer Communications & Networking Conference (CCNC), pp. 107–112, 2024

    2024

  26. [34]

    Improving IoT Security With Explainable AI: Quantitative Evaluation of Explainability for IoT Botnet Detection,

    Rajesh Kalakoti, Hayretdin Bahsi, and Sven Nõmm, “Improving IoT Security With Explainable AI: Quantitative Evaluation of Explainability for IoT Botnet Detection,” IEEE Internet of Things Journal, 2024

    2024

  27. [35]

    Robust network anomaly detection using ensemble learning approach and explainable artificial intelligence (XAI),

    Mohammad Kazim Hooshmand, Manjaiah Doddaghatta Huchaiah, Ahmad Reda Alzighaibi, Hasan Hashim, El-Sayed Atlam, and Ibrahim Gad, “Robust network anomaly detection using ensemble learning approach and explainable artificial intelligence (XAI),” Alexandria Engineering Journal, vol...

    2024

  28. [36]

    NSL-KDD | Datasets | Research | Canadian Institute for Cybersecurity | UNB,

    Canadian Institute for Cybersecurity, “NSL-KDD | Datasets | Research | Canadian Institute for Cybersecurity | UNB,” [Online]. Available: https://www.unb.ca/cic/datasets/nsl.html. (Accessed on 07/16/2024)

    2024

  29. [37]

    Evaluating The Explainability of State-of-the-Art Machine Learning- based IoT Network Intrusion Detection Systems,

    Ayush Kumar and Vrizlynn L.L. Thing, “Evaluating The Explainability of State-of-the-Art Machine Learning- based IoT Network Intrusion Detection Systems,” arXiv preprint arXiv:2408.14040, 2024

    2024

  30. [38]

    Trust XAI: Model-agnostic explanations for AI with a case study on IIoT security,

    Maede Zolanvari, Zebo Yang, Khaled Khan, Raj Jain, and Nader Meskin, “Trust XAI: Model-agnostic explanations for AI with a case study on IIoT security,” IEEE Internet of Things Journal, vol. 10, no. 4, pp. 2967–2978, 2021

    2021

  31. [39]

    The UNSW-NB15 Dataset | UNSW Research,

    UNSW Research, “The UNSW-NB15 Dataset | UNSW Research,” [Online]. Available: https://research. unsw.edu.au/projects/unsw-nb15-dataset. (Accessed on 07/16/2024)

    2024

  32. [40]

    Intrusion detection by machine learning: A review,

    Chih-Fong Tsai, Yu-Feng Hsu, Chia-Ying Lin, and Wei-Yang Lin, “Intrusion detection by machine learning: A review,” Expert Systems with Applications, vol. 36, no. 10, pp. 11994–12000, 2009

    2009

  33. [41]

    How can I choose an explainer? An application-grounded evaluation of post-hoc explanations,

    Sérgio Jesus, Catarina Belém, Vladimir Balayan, João Bento, Pedro Saleiro, Pedro Bizarro, and João Gama, “How can I choose an explainer? An application-grounded evaluation of post-hoc explanations,” in Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Tra...

    2021

  34. [42]

    Statistical comparisons of classifiers over multiple data sets,

    Janez Demšar, “Statistical comparisons of classifiers over multiple data sets,” The Journal of Machine Learning Research, vol. 7, pp. 1–30, 2006

    2006

  35. [43]

    Wilcoxon signed-rank test,

    Robert F. Woolson, “Wilcoxon signed-rank test,” Encyclopedia of Biostatistics, vol. 8, 2005

    2005

  36. [44]

    Explainable Federated Learning for Botnet Detection in IoT Networks,

    Rajesh Kalakoti, Hayretdin Bahsi, and Sven Nõmm, “Explainable Federated Learning for Botnet Detection in IoT Networks,” in 2024 IEEE International Conference on Cyber Security and Resilience (CSR), pp. 01–08, 2024. 15

    2024

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.